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The impossibility of perfectly copying (or cloning) an arbitrary quantum state is one of the basic 
rules governing the physics of quantum systems. The processes that perform the optimal approx- 
imate cloning have been found in many cases. These "quantum cloning machines" are important 
tools for studying a wide variety of tasks, e.g. state estimation and eavesdropping on quantum 
cryptography. This paper provides a comprehensive review of quantum cloning machines (both for 
discrete-dimensional and for continuous- variable quantum systems); in addition, it presents the 
role of cloning in quantum cryptography, the link between optimal cloning and light amplification 
via stimulated emission, and the experimental demonstrations of optimal quantum cloning. 
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I. CLONING OF QUANTUM INFORMATION 
A. Introduction 

The concept of "information" is shaping our world: 
communication, economy, sociology, statistics... all ben- 
efit from this wide-encompassing notion. During the last 
decade or so, information entered physics from all sides: 
from cosmology (e.g. entropy of black- holes"'^) to quan- 
tum physics (the entire field of quantum information pro- 
cessing). Some physicists even try to reduce all natu- 
ral sciences to mere information jBrukner and Zeilingerl 
I20n2t ICollins fiii all 120041: iFuchsL 120021) . In this review, 
we concentrate on one of the essential features of informa- 
tion: the possibility to copy it. One might think that this 
possibility is an essential feature of any "good" encod- 
ing of information. This is however not the case: when 
information is encoded in quantum systems, in general 
it cannot be replicated without introducing errors. This 
limitation, however, does not make quantum information 
useless — quite the contrary, as we are going to show. 

But we should first answer a natural question: why 
should one encode information in quantum systems? 
Well, in the final analysis, the carriers of information 
can only be physical systems (" information is physical" , 
as Rolf Landauer summarized it); and ultimately, phys- 
ical systems obey the laws of quantum physics. So in 
some sense, the question that opened this paragraph can 
be answered with another question: do you know any car- 
riers of information, other than quantum systems? The 
answer that most physicists give is, "No, because every- 
thing is quantum" — indeed, the boundary between the 
classical and the quantum world, if any such boundary 
exists, has not been identified yet. Other reasons to be in- 
terested in quantum information will soon become clear. 

Still, even if the carrier of information is a quantum 
system, its encoding may be classical. The most striking 
example found in nature is DNA: information is encoded 
by molecules, which are definitely quantum systems; but 
it is encoded in the "nature" of the molecules (adenine, 
thymine, cytosine, guanine), not in their state^. Such 
an encoding is classical, because one cannot find a su- 
perposition of "being adenine" and "being thymine". If 
information is encoded this way, it can be replicated per- 
fectly: this process is called cloning, nature performs it 
and biologists are struggling to master it as well. 

Here, we concentrate on the quantum encoding of in- 
formation, when information is encoded in the state ■0 of 
quantum systems. The process of replicating the state. 



written tp ^ ip ig) and called cloning as well, can be 
done perfectly and with probability 1 if and only if a 
basis to which -0 belongs is known. Otherwise, perfect 
cloning is impossible: either the copies are not perfect, 
or they are perfect but sometimes the copying process 
simply gives no outcome. These are the content and the 
consequences of the no-cloning theorem of quantum in- 
formation. Similar to Heisenberg's uncertainty relations, 
the no-cloning theorem defines an intrinsic impossibility, 
not just a limitation of laboratory physics. 

After some thinking though, one may object that the 
possibility of classical telecommunication contradicts the 
no-cloning theorem: after all, information travelling in 
optical fibers is encoded in the state of light, so it should 
be a quantum encoding; and this information is ampli- 
fied several times from the source to the receiver, so it 
should degrade. Indeed, it does. However, a telecom sig- 
nal consists of a large number of photons prepared in the 
very same quantum state; so, amplification in telecom 
amounts to producing some new copies of t/j out of t/j^^ . 
In short, the no-cloning theorem does apply to the ampli- 
fication of telecom signals, because spontaneous emission 
is always present in amplifiers; but the copy is almost 
perfect, because stimulated emission is the dominating 
effect. The sensitivity of present-day devices is such that 
the quantum limit should be reached in the foreseeable 
future^. 

We left for the end of the introduction the most sur- 
prising: an encoding of information that obeys the no- 
cloning theorem is helpful. The impossibility of perfectly 
copying quantum information does not invalidate the en- 
tire concept of quantum information. Quite the opposite, 
it provides an illustration of its power. There is no way 
for someone to perfectly copy the state of a quantum 
system, for a clever encoding of information which uses 
a set of non-orthogonal states. Consequently, if such a 
system arrives unperturbed at a receiver, then, for sure, 
it has not been copied by any adversary. Hence, due to 
the no-cloning theorem, quantum information provides a 
means to perform some tasks that would be impossible 
using only ordinary information, such as detecting any 
eavesdropper on a communication channel: this is the 
idea of quantum cryptography. 

The outline of the review will be given in paragraph 
II.D.3I after some concepts have been introduced. We 
start by stating and demonstrating the no-cloning theo- 
rem, and by sketching its history. 



^ The widely discussed topic of black-hole evaporation is also a 
matter of information: is all the information that has entered 
a black-hole lost forever — technically, does irreversible non- 
unitary dynamics exist in nature? 

^ This does not necessarily imply that the way Nature processes 
this information is entirely classical: this point is an open ques- 
tion. 



^ The security parameter for the acceptable error is presently set 
at e = 10~^. Let's make a simple estimate of the ultimate quan- 
tum limit that corresponds to it: the signal is a coherent state 
la), and let's say that an error is possible for the vacuum compo- 
nent, because for that component there is no stimulated emission. 
Then e ^ \(a\0)\^ = exp(— lap), which is equal to 10~® for an 
average number of photons |ap 20. In actual networks, a tele- 
com pulse that has travelled down a fiber reaches the amplifier 
with an intensity of some 100 photons on average. 



B. The no-cloning theorem 

It is "well-known that one cannot measure the state 
\ip) of a single quantum system: the result of any single 
measurement of an observable A is one of its eigenstates, 
bearing only very poor information about |^), namely 
that it must not be orthogonal to the measured eigen- 
state. To reconstruct (or more generally, any mixed 
state p) one has to measure the average values of sev- 
eral observables, and this implies making statistical aver- 
ages over a large number of identically prepared systems 
l|Wootters and Field d Il989fl . One can imagine how to 
circumvent this impossibility in the following way: take 
the system in the unknown state jV') and let it interact 
with N other systems previously prepared in a blank ref- 
erence state in order to obtain TV -|- 1 copies of the 
initial state: 



xlz 



QCM 



M 



IV-) ® \R).: ® — ^ IV') ® \^)- ® ■ 



(1) 



Such a procedure would allow one to determine the quan- 
tum state of a single system, without even measuring it 
because one could measure the N new copies and leave 
the original untouched. The no-cloning theorem of quan- 
tum information formalizes the suspicion that such a pro- 
cedure is impossible: 

No-cloning theorem: No quantum operation exists that 
can duplicate perfectly an arbitrary quantum state. 

The theorem can be proved with a reductio ad absur- 
dum by considering the 1 — s- 2 cloning. The most gen- 
eral evolution of a quantum system is a trace-preserving 
completely-po sitive (CP) map. A well-known theorem 
l|Krausl Il983l) says that any such map can be imple- 
mented by appending an auxiliary system (ancilla) to 
the system under study, let the whole undergo a unitary 
evolution, then trace out the ancilla. So let us suppose 
that perfect cloning can be realized as a unitary evolu- 
tion, possibly involving an ancilla (the " machine" ) : 



® \R) (g) \M) 



ui 



(2) 



In particular then, for two orthogonal states labelled |0) 
and we have: 



|0) ® \R) (g) \M) 
|1) \R)(g\M) 



\0) (E) \0) (E) \M{0)) , 
\1) (E) \1) (E> \M{1)) . 



But because of linearity (we omit tensor products) these 
conditions imply: 

(|0) + |l»|i?)|Al> ^ |00)|A1(0)> + |11)|X(1)>. 

The r.h.s. cannot be equal to (|0) + |1))(|0) + 
|1)) |A^(0 + 1)> = (|00> + |10) + |01) + 111)) \MiO + 1)). 
So Q may hold for states of an orthonormal basis, but 
cannot hold for all states. This concludes the proof using 
only the li nearity of quantum transfor mations following 
the work of lWootters and Zuretd l)l982|) : a sHghtly differ- 
ent proof, using more explicitly the properties of unitary 
operat i ons, c an be found in Sect. 9-4 of Peres' textbook 
(iPeresl 119951) . 



FIG. 1 Setup devised by Herbert to achieve signaling. A 
source S produces pairs of qubits in a maximally entangled 
state; on the left, Alice measures either or a^. On the right. 
Bob applies a perfect quantum cloning machine (QCM) and 
then measures the two clones (the measurement M may be 
individual or collective). 



C. History of the no-cloning theorem 

1. When "wild" ideas trigger deep results 

Historically, the no-cloning theorem did not spring out 
of deep thoughts on the quantum theory of measure- 
ment. The triggering event was a rather unconventional 
proposal by Nick Herbert to use quantun i corre lations 
to communicate faster-than-light ijHerbertl Il982|) . Her- 
bert called his proposal FLASH, as an acronym for "First 
Light Amplification Superluminal Hookup" . The argu- 
ment goes as follows (Fig.^. Consider two parties, Alice 
and Bob, at an arbitrary distance, sharing two qubits'* in 
the singlet state |*-) = ^ (|0)^ ® - Wa ® |0>b)- 
On her qubit, Alice measures either ax or cr^. Because 
of the properties of the singlet, if Alice measures cr^, she 
finds the eigenstate |0) (resp. |1)) with probability i, 
and in this case she prepares Bob's qubit in the state |1) 
(resp. |0)). Without any knowledge on Ahce, Bob sees 
the mixed state i|0)(0| -I- ^|1)(1| = ^1, just as if Alice 
had done nothing. Similarly, if Alice measures ax, she 
finds the eigenstate |-|-) (resp. |— )) with probability ^, 
and in this case she prepares Bob's qubit in the state |— ) 
(resp. |-f )). Again, without any knowledge on Alice, Bob 
sees the mixed state 5l+)(+| + )(— | = ^1- 

However, suppose that Bob has a perfect 1^2 
doner, QCM in Fig. ^ and that he has his qubit pass 
through it. Now, if Alice measures ax, Bob's mixture is 

Px = |l + +)(++ I + |l )( I; if Alice measures 

a^, Bob's mixture is = 5|00)(00| + i|ll)(ll|. It is 
easily verified that px ^ Pz (for instance, (01|pj;|01) = j 
while (OljpzlOl) — 0). Thus, at least with some prob- 
ability, by measuring his two perfect clones. Bob could 
know the measurement that Alice has chosen without any 
communication with her. 



This is an obvious violation of the no-signaling con- 
dition, but the argument was clever — that is why it 



^ A qubit is a two-dimensional quantum system. In this paper, the 
mathematics of qubits are used extensively: we use the standard 
notations of quantum information, summarized in Appendix 1X1 
together with some useful formulae. We shall also use the term 
qudit to designate a d-level quantum system. 
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was published dPercs', '200 j) — and t ri ggered the re - 
sponses^ of iWootters and ZureU (Il982i). Diekl ^ll982^ 
iMilonni and Hardiej l|l982^ an'd sUghtly later iMandell 
In these papers, the no-cloning theorem was 
firmly established as a consequence of the linearity of 
quantum mechanics. It was also shown that the best- 
known amplification process, spontaneous and stimu- 
lated emission of a photon by an excited s ystem, was per- 
fectly consistent with this no-go theorem iMande j 119831 
IMilonni and Hardieslll982HWootters and ZureU.ll982|) . 



2. Missed opportunities 

Once the simplicity of the no-cloning theorem is no- 
ticed, one cannot but wonder why its discovery was de- 
layed until 1982. There is no obvious answer to this ques- 
tion. But we can review two " missed opportunities" . 

In 1957, during a sabbatical in Japan, Charles Townes 
worked out with Shimoda and Takahasi the phenomeno- 
logical equations which describe the amplification in 
the maser that he ha d demonstrated four years before 
l|Shimoda et a/.lll957t |T owncs, 2 002j). In this paper, see 
discussion in paragraph IVI.A.3I for more details, some 
rate equations appear from which the "fidelity" of op- 
timal quantum cloning processes^ immediately follows. 
At that time however, nobody used to look at physics in 
terms of information; so in particular, nobody thought 
of quantifying amplification processes in terms of the ac- 
curacy to which the input state is replicated. 

The second missed opportunity involved Eugene Paul 
Wigner. In a Festschrift, he t ackled the question of bio- 
logical cloning ijWigneil Il96l|) . Wigner tentatively iden- 
tified the "living state" with a pure quantum mechani- 
cal state, noted f; he then noticed that, among all the 
possible unitary transformations, those that implement 
v u ®v ®r are a negligible set — but he did not 

notice that no transformation realizes that task for any 
v, which would have been the no-cloning theorem. From 
his observation, Wigner concluded that biological repro- 
duction " appears to be a miracle from the point of view 
of the physicist" . We know nowadays that his tentative 
description of the living state is not correct, and that re- 
production is possible because the encoding in DNA is 
classical (see the Introduction of this review). 



^ NG: "I vividly remember the conference held somewhere in Italy 
for the 90th birthday of Louis de Broglie. I was a young PhD stu- 
dent. People around me were all talking about a "FLASH com- 
munication" scheme, faster than light, based on entanglement. 
This is where - I believe - the need for a no-cloning theorem 
appeared. Zurek and Milonni were among the participants." 

® Specifically, universal symmetric N ^ M cloning of qubits, see 
below. 



3. From no-cloning to optimal cloning 

Immediately after its formulation, the no-cloning the- 
orem became an important piece of physics, cited 
in connection with both no-signaling ( Bussevl . ; 
Ghirardi and Webeii I1983D and amplification l|YuerJ . 

Interestingly, no-cloning was invoked to argue 
for the seci irity of q uantum cryptograph y from the very 
beginning teennett and Br assardi Il984) . Sect. 9-4 of 
Peres' book (jPerest il995i|l is a good review of the role 
of the the orem before 1996. In the first months of that 
very year, iBarnum et al\ ()l996fl considered the possibil- 
ity of the perfect cloning of non-commuting mixed states, 
and reach the same no-go conclusion as for pure states. 
Everything fell into place. 

The situation suddenly changed a few months later: in 
the September 1996 issue of Physical Review A, Vladimir 
Buzek and Mark Hillery published a paper whose title 
i s "Quantum copying: be yond the no-cloning theorem" 
l)Buzek and Hillervlll996j) . Of course, they did not claim 
that the no-go theorem was wrong. But the theorem ap- 
plied only to perfect cloning, whereas Buzek and Hillery 
suggested the possibility of imperfect cloning. Specifically 
fsee III. A1 below for all details), they found a unitary op- 
eration 

ABM (3) 

such that the partial traces on the original qubit A and 
on the cloned qubit B satisfy 

PA^ PB ^ F\i>){^\ + (1 - F)|V'^)(V^^| (4) 

with a fidelity F that is "not too bad" (|) and is the 
same for any input state 1-0). The Buzek-Hillery unitary 
transformation is the first Quantum Cloning Machine] it 
triggered an explosion in the number of investigations on 
quantum cloning. 

D. Quantum Cloning Machines (QCIVI): generalities 

1. Definition of cloning 

Any interaction (i.e. any CP map) between two quan- 
tum systems A and B, possibly mediated by an ancilla 
M, has the effect of "shuffling" the quantum informa- 
tion between all the sub-systems. When the input state 
takes the form t'^^'^ output of any CP 

map the quantum information contained in will have 
been somehow distributed among A and B (and possi- 
bly the ancilla) . This suggests the following definition of 
the process of cloning of pure states, that we generalize 
immediately to the case of iV ^ M cloning: 

(l^)^"^) ® ® \M) ^ I*) (5) 

where |^) is the state of TL to be copied, \B) is a reference 
state arbitrarily chosen in the same Hilbert space TL, and 
\M.) is the state of the ancilla. In other words: 



5 



• The fact that the process is a form of cloning is 
determined by the form of the input state, l.h.s. of 
(jnj: N particles ("originals") carry each the pure 
state lip) to be copied. In particular then, the N 
originals are disentangled from the M — N parti- 
cles that are going to carry the " copies" (that start 
in a blank state) and from the "ancillae". In fact, 
sometimes (e.g. in paragraphs III. CI III. Dp it will 
be convenient to consider that the copies and the 
ancillae start in an entangled state. This does not 
contradict one simply omits to mention a "triv- 
ial" part of the QCM, that prepares the copies and 
the ancillae in the suitable state. It is important to 
stress that we consider only pure states as inputs; 
to our knowledge, there are no results on QCM that 
would be optimal for mixed states. 

• The cloning process (jSJ is defined by the Quan- 
tum Cloning Machine (QCM), which is the trace- 
preserving CP map, or equivalcntly the pair 



QCM = {U,\M)]. 



(6) 



A QCM can be seen as a "quantum processor" U, 
that processes the input data according to some 
"program" \M.). Examples of QCM, that produce 
clones of very different quality, are easily found: 
just take the identity \^)A\R)g j^\R) g that 

transfers no information from A to B, or the swap 
^ \R) a\'^) B ^^^^ transfers all the infor- 
mation from A to B — both unitary operations, 
with no ancilla. The possibility to define coherent 
combinations of such processes suggests that non- 
trivial QCM can be found: and indeed, we'll see 
that this intuition is basically correct (see particu- 
larlv lII.C!|) , although not fully, because ancillae play 
a crucial role. 



2. Fidelity, and the Glossary of QCM 

Having defined the meaning of " cloning" , we can in- 
troduce the basic glossary that is used in the study and 
classification of QCMs. The very first object to define 
is a figure of merit according to which the output of the 
QCM should be evaluated. The usual figure of merit is 
the single- copy fidelity^ called simply fidelity unless some 
ambiguity is possible. This is defined for each of the out- 
puts j = 1...M of the cloning machine, as the overlap 
between pj and the initial state \ip)'- 



F, = (VIpjIV'), j = i,...,m 



(7) 



where Pj is the partial state of clone j in the state 
defined in jS)). Note that the worst possible fidelity for 
the cloning of a d-dimensional quantum system is Fj — ^ , 

obtained if pj is the maximally mixed state i . 

The following, standard classification of QCM follows: 



• A QCM is called universal if it copies equally well 
all the states, that is, if Fj is independent of 
The notation UQCM is often used. Non-universal 

QCM are called state- dependent. 

• A QCM is called symmetric if at the output all the 
clones have the same fidelity, that is if Fj = Fji for 
all j, / = 1,...,M. For asymmetric QCM, further 
classifications are normally needed: for instance, in 
the study of 1 — 3 asymmetric QCM, one may 
restrict to the case Fi ^ F2 = F3 (that we shall 
write I ^ 1 -I- 2) or consider the general case 1 
1-l-l-f 1 where all the three fidelities can be different. 

• A QCM is called optimal if, for a given fidelity 
of the original(s), the fidelities of the clones are 
the maximal ones allowed by quantum mechan- 
ics. More specifically, if S is the set of states 
to be cloned, optimality can be defined by max- 
imizing either the average fidelity over the states 
F = d'ipF{iJj), or the minimal fidelity over the 
states Fmin — niin^£5 _F(V^). These definitions of- 
ten coincide. 

According to this classification, for instance, the Buzek- 
Hillery QCM is the optimal symmetric UQCM for the 
cloning I — > 2 of qubits. The generalization to optimal 
symmetric UQCM for the cloni ng N ^ M have been 
rapid l y found, first for qubits (Brufi. DiVincenzo et all 
119981: iGisin and MassaA Il997^■ then for arbitrary- 
dime nsional svstems l)Kevl and Werneil Il999t IWerneii 
Il998|) . Also the family of optimal asymmetric UQCM 
for the cloning 1 1 -I- 1 of arbitrarv dimension has 




1 llBraunstein. Buzek and Hillervl 


iFiurasek. Filiu and Ceri 


J2OO5I 


Iblisdir. Acm and Gisinl. 1 


200^ 



The study of the optimal universal asymmetric QCM 
N — > Ml + A/2 has been undertaken later, motivated 
by the fact that the 2 ^ 2 -I- 1 QCM is needed for the 
security analysis of quantum cryptography protocols. As 
the reader may easily imagine, the full zoology of QCM 
has not been explored: there are hard problems that 
wait for a motivation. For instance, very few examples 
of optimal state-dependent QCM are known. 



3. Outline of the paper 

The outline of this review is as follows. In Section 
im we review the cloning of discrete quantum systems, 
presenting the QCMs for qubits and stating the general- 
izations to larger-dimensional systems. We introduce at 
the end of this section the link between cloning and state 
estimation. In Section IlIII we will review the cloning of 
continuous variables. Section HVI is devoted to the appli- 
cation of quantum cloning for eavesdropping in quantum 
cryptography. The last two sections are devoted to the 
realization of quantum cloning. Section shows how 
the amplification based on the interplay of spontaneous 
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and stimulated emission achieves optimal cloning of dis- 
crete systems encoded in different modes of the light field. 
We present a self-contained derivation of this claim. In 
Section IVII we review the experimental proposals and 
demonstrations of cloning, for the polarization of pho- 
tons and for other physical systems. 

Some topics related to cloning are omitted in this 
review. One of them is proba bilistic exact cloning 
l|Duan and Gud Il998t iPati Il999fl : while in the spirit 
of Buzek-Hillery one circumvents the no-cloning theorem 
by allowing imperfect cloning, in probabilistic cloning 
one wants to always obtain a perfect copy, but the price 
is that the procedure works only with some probabil- 
ity. This is related to unambiguous state discrimination 
procedures in state-estimation theory. In comparison to 
probabilistic cloning, the cloning procedures d la Buzek- 
Hillery that we describe in this review are called deter- 
ministic cloning, because the desired result, namely im- 
perfect copying, is always obtained. Hybrid strategies 
between probabilistic-exact and deterministic-imperfect 
cloning have also been studied and compared to results 
of state-estimation theory ( Cliches and Barnett, 1999). 

Another topic that will be omitted is telecloning, that 
is, cloning at a distance. In this protocol, a party Al- 
ice has a copy of an unknown quantum state, and wants 
to send the best possibly copy to each of M partners. 
An obvious procedure consists in performing locally the 
optimal 1 ^ M cloning, then teleporting the M parti- 
cles to each partner; this strategy requires M singlets 
(that is, M bits of entanglement or e-bits) and the com- 
munication o f 2M classical bits. It has been proved 
llMurao et al 1 1199^0 that other strategies exist, that are 
much cheaper in terms of the required resources. In par- 
ticular, the partners can share a suitable entangled state 
of only 0(log2 M) e-bits, and in this case the classical 
communication is also reduced to public broadcasting of 
two bits. 



E. No-cloning and other "limitations" 

As a last general discussion, we want to briefly sketch 
the link between cloning and other " limitations" that are 
found in quantum physics; specifically, the no-signaling 
condition and the uncertainty relations. 



1. Relation to no-signaling 

As we said in paragraph II. CI a perfect doner would 
allow signaling through entanglement alone. Sho rtly af- 
ter the idea of imperfect cloning was put forward, ijGisinL 
[1998) noticed that one can also study optimal imperfect 
cloning starting from the requirement that no-signaling 
should hold. The proof was given for universal symmetric 
1 — > 2 cloning for qubits. The idea is to require that the 
input state = ^ {'^ + rh ■ a) is copied into a two 

qubit state such that the two one-qubit partial states are 



equal and read pi = p2 = 5 (1 + • a): i.e., the Bloch 
vector points in the same direction as for the original 
but is shrunk by a factor 77 {shrinking factor), related to 
the fidelity defined in Q through F — On the one 
hand, we know from the no-cloning theorem that rj — 1 
is impossible and would lead to signaling; on the other 
hand, 77 = is obviously possible by simply throwing 
the state away in a non-monitored mode and preparing a 
new state at random. So there must be a largest shrink- 
ing factor r] compatible with the no-signaling condition. 

The form of the partial states pi^2 implies that the 
state of systems 1 and 2 after cloning should read 

PoutW = ^(^ti + 1] (m ■ a ^ 1 + 1 ^ rh ■ a) 

+ ^ tijffi (g) CTj j . (8) 

The tensor tij has some structure because of the require- 
ment of universality, that implies covariance: 

Pout{U\^)) = U®Upout{ij)U^ (dUK (9) 

This means that the following two procedures are equiv- 
alent: to apply a unitary U on the original and then the 
doner, or to apply the doner first and then U to both 
copies. 

These are the requirements of universality, rj account- 
ing for imperfect cloning. With this definition of QCM, 
one can run again the Gedankenexperiment discussed in 
paragraph II. CI (Fig. Bob's mixtures after cloning 
read now p^ = \ Pout{+x) + \ Pout{-x) and pz = 
\ Pouti+z) + \ Pout{-z). No-signaling requires Px ^ Pz- 
By using the fact that density matrices must be posi- 
tive operators, one finds after some calculation the bound 

< I (-f ^ |) for any universal symmetric 1^2 QCM 
for qubits. This analysis alone does not say whether 
this bound can be attained; but we know it can: the 
Buzek-Hillery QCM reaches up to it. Thus, the no- 
signaling condition provides a bound for the fidelity of 
quantum cloning, and this bound is tight since there ex- 
ists a QCM that saturates it; in turn, this provides a 
proof of the optimality of the Buzek-Hillery QCM. The 
argument can be generalized for the 1 — > iV symmetric 
cloning f|Simon„ .2001.') . Other QCMs on the edge of the 
no-signaling condition have been described more recently 
llNavez a,nd Cerfll2nn.'^ . 

In conclusion, the no-signaling condition has been 
found to provide tight bounds for cloning — in fact, 
this observation was extended to an y linear trace- 
preserving CP map (Simon et ali l200ll) . The converse 
statement also holds: no linear trace-preserving CP 
map (so in particular no Q CM) can lead to signahng 
(|Brufi. D'Ariano et QiJ . l200'nl) . Finally, it has been proved 
recently that no-cloning is a f eature that holds for all 
non-local no-signaling theories ijMasanes et all l2005j) . 
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2. Relation to uncertainty relations and knowledge 

In addition to allowing signaling through entanglement 
alone, perfect cloning would also violate one of the main 
tenets of quantum mechanics, namely that the state of 
a single quantum system cannot be known^. If perfect 
cloning were possible, one could know everything of a 
single particle's state without even measuring it, just by 
producing clones and measure these fsee II.B|) . In turn, 
this would invalidate quantum cryptography (see Sec- 
tion and lead to the violation of some information- 
the oretical principles, s uch a s Landauer's erasure princi- 
ple l|Plenio and Vitellil . l200l[) . The link between optimal 
cloning and the amount of knowledge that one can obtain 
on the state of a limited number of quantum systems (in 
the limit, just one) can be made quantitative, see III. El in 
this review. 

Of course, perfect cloning would not invalidate the ex- 
istence of incompatible observables: having N copies of 
an eigenstate of CTz does not mean that the result of a 
measurement of ax becomes deterministic. In particular, 
the relation between observables AAAB > ^\{[A,B])\ 
would still hold in the presence of perfect cloning. 



II. CLONING OF DISCRETE QUANTUM SYSTEMS 

In this Section, we review the main results about 
cloning of discrete quantum systems, that is, systems de- 
scribed by the Hilbert space 7i = C"^. We start from 
the simplest case, 1 — > 2 symmetric cloning for qubits, 
and describe the Buzek-Hillery QCM IjlLAI) . Then, we 
present the two natural extensions: N M symmetric 
cloning ljII.B|l , and 1^1-1-1 asymmetric cloning (jlLCjl . 
The last paragraph of this Section is devoted to state- 
dependent cloning IjlLDjl . An important remark when 
comparing with the original articles: in this review, we 
use d systematically for the dimension, and capital letters 
such as N and M for the number of quantum systems. 
This notation is nowadays standard; however, until re- 
cently, N was often used to denote the dimension of the 
Hilbert space. 



Invoking the same argument as in paragraph 9-4 of Peres' book 
iPered fl995t) . perfect cloning would thus lead to a violation of 
the second law of thermo dynamics. However, the cogency of this 
argument is disputed ("see lMana et al. 12005) for a recent analy- 
sis). In fact, to derive the violation of the second law, one makes 
the assumptions that (i) non-orthogonal states are deterministi- 
cally distinguishable, and (ii) entropies are computed using the 
quantum formalism. Clearly, the two assumptions already look 
contradictory. 



A. Symmetric 1^2 UQCM for qubits 

1. Trivial cloning 

In order to appreciate the performance of the optimal 
1 — > 2 cloning for qubits (Buzek-Hillery), it is convenient 
to begin by presenting two trivial cloning strategies. The 
first trivial cloning strategy is the "measurement-based" 
procedure: one measures the qubit in a randomly chosen 
basis and produces two copies of the state corresponding 
to the outcome. Suppose that the original state is | -I- a), 
whose projector is ^(l-t-a-tr), and that the measurement 

basis are the eigenstates of 6 • ct. With probability P± = 
|(1 ± a • 6), two copies of | ± 6) are produced; in either 

case, the fidelity is F± = \ {+d\ ± 6)P = P±- The average 
fidelity is 

Ft„v,i = I rf6(P+F++P_F_) 

JS2 

1 1 /■ ^ / ^\ 2 2 
= 2 + 2X/K'^-0 -3 

where 5*2 is the 2-sphere of unit radius (surface of the 
Bloch sphere). This cloning strategy is indeed universal: 
the fidelity is independent of the original state \+ a). 

The second trivial cloning strategy can be called "triv- 
ial amplification" : let the original qubit fly unperturbed, 
and produce a new qubit in a randomly chosen state. 
Suppose again that the original state is \-\- a), and sup- 
pose that the new qubit is prepared in the state | -I- . 
We detect one particle: the original one with proba- 
bility i and in this case F — 1; the new one with 
the same probability and in this case the fidelity is 
F ~ |(+a| + 6)p = P+. Thus the average single-copy 
fidelity is 

= 2 + 2i/'(^^j =4- 

This second trivial strategy is also universal. In conclu- 
sion, we shall keep in mind that a fidelity of 75% for 
universal 1^2 cloning of qubits can be reached by a 
rather uninteresting strategy. 



2. Optimal Symmetric UQCM (Buzek-Hillery) 

It's now time to present explicitly the symmetric 
UQCM for 1^2 cloning of qubits found by Buzek and 
HiUery (B-H). This machine needs just one qubit as an- 
cilla. Its action in the computational basis of the original 
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qubit is^ 



mR)\M) 

Hi))\R)\M) 



|0>|0>|1> - 
|1>|1)|0) - 



>|0> 



(12) 



with 1^'+) = -i=[|l)|0) + |0>|1>]. By linearity, these two 
relations induce the following action on the most general 
input state \tp) = a\0) + /3|1): 



mR)\M) 



+ (13) 



where IV'"^) = a*|l) -/3*|0). 

From Eq. (O, one sees immediately that A and B can 
be exchanged, and in addition, that the transformation 
has the same form for all input state {ip). Thus, this 
QCM is symmetric and universal. The partial states for 
the original and the copy are 



PA = PB 



1 / 2 
2(^+3™- 



(14) 



From the standpoint of both A and B then, the B- 
H QCM shrinks the original Bloch vector rn by a 
shrinking factor ?7 = |, without changing its direction. 

" ----- p 



As mentioned previously, the fidelity is Fa 
(iplpAl'ip) = |, outperforming the trivial strategies de- 
scribe d above. This was proved later to be the optimal 



value (BruB. DiVi ncenzo et a/.l .*1998':'G isin and Massail 
[T997: .Gisin . 19 9- 8<) ■ in their original paper, Buzek and 
Hillery had proved the optimality of their transformation 
with respect to two different figures of merit. 



3. The transformation of the ancilla: "anti-clone" 

Although everything was designed by paying attention 
to qubits A and B, the partial state of the ancilla turns 
out to have a quite interesting meaning too. We have 

PM = ^|V^^>(^^| + i|V)(^| = i(l-im.<7).(15) 

This state is related to another operation which, like 
cloning, is impossible to achieve perfectly, namely the 
NOT operation that transforms \tp) = a\0) + (3\1) into 



= all 



/3*|0). Because of the need for complex 



We rewrite, with a change of notati on for the ancilla states, 
Eq. (3.29) of lBuzek and Hillervl figQel) . 



conjugation of the coefficients, the perfect NOT transfor- 
mation is anti- unitary and cannot be performed^. Just 
as for cloning, one can choose to achieve the NOT on 
some states while leaving other states unchanged; or 
one can find the operation that approximates at best 
the NOT on all states, called the universal NOT (U- 
NOT). This operation was anticipated in a remark by 
iBechmann-Pasquinuc ci and Gisin ( 1999 .), the n fully de- 
scribed by feuzek. Hillerv and WerneiflllQQgj) . The U- 
NOT gate gives precisely pnot = Pm, and is thus im- 
plemented as a by-product of cloning^". It has become 
usual to say that, at the output of a QCM, the ancilla 
carries the optimal anti-clone of the input state. 



B. Symmetric UQCM N 



M 



A symmetric, universal N ^ M QCM for 
qubits that generalizes the B-H QCM was found by 
iGisin and MassaJ l)l997j) . Its fidelity is 

MN +M+N 
Fn^m = r- ^ (d = 2 16 

M(N + 2) ^ ' ^ ' 

that reproduces Fi^2 = f for = 1 and M = 
2. They gave numerical evidence for its optimality. 
Later, an analytical proof of optim ality was given by 
IbT^ Ekert and Macchiavelld l) 1998(1 , who assumed that 
the output state belongs to the symmetric subspace of 
M qubits (this assumption is unjustified a priori but 
turns out to be correct, see below). The result was fur- 
ther general ized by Werner f or systems of any dimension 



tner generai izea Dy Werner t or systems c 
l|Kevl and Werner. 1999: We^^lT998|) . 



1. Werner's construction 

We consider d-dimensional quantum systems described 
by the Hilbert space H = C^. We introduce the notation 
for the symmetric subspace of the n-fold tensor prod- 
uct Ti*^"; the dimension of is d[n] d + n 1 



n - 
n 



The input state is pat = a'^ £ "H^, where a = |V')(V'I 
is a pure state. The QCM is described by a trace pre- 
serving CP-map T -.n^ ^ Ti®"'. The remarkable fact 
is that one can restrict to CP maps whose output is in 



Here is an intuitive version of this impossibility result: any uni- 
tary operation on a qubit acts as a rotation around an axis in the 
Bloch sphere, while the NOT is achieved as the point symmetry 
of the Bloch sphere through its center. Obviously, no rotation 
around an axis can implement a point symmetry. A rotation of 
7r around the axis z achieves the NOT only for the states in the 
(a;, y) plane, while leaving the eigenstates of invariant. 
Contrary to cloning however (see the first trivial cloning 
strategy described above Ill.A.li . the optimal fidelity for the 
NOT can be reached also in a measurement-based scenario 
iBuzek. Hillerv and Werneil [T999h . 
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the symmetric subspace TC^ . This is clearly true if one 
considers " all-particle test criteria" , such as minimizing 
the trace-distance between pM and a'^^ or maximizing 
the all -particle fidelit y Faii = Tr[cr®^ pm] , as figures of 
merit ijWerneil Il998|) : but if one wants to optimize the 
single-copy fidelity, the restriction to the symmetric sub- 
space is not apparent at all, and required further work 
before being demonstrated ( Kcvl and Werner, 1999.) . 

In any case, the difficulty of the optimality proofs 
should not hide the simplicity of the result: a single T 
optimizes all the figures of merit that have been con- 
sidered, and this T is in some sense the most intuitive 
one. One simply takes the non-symmetric trivial exten- 
sion pN pN ® Ti-M-N, symmetrizes it and normalizes 
the result. Explicitly, the optimal symmetric UQCM for 
N ^ M cloning reads 



N 



d[N] 
d[M] 



Sm [pn ® ^m-n) Sm (17) 



where Sm is the projector from 7^®*^ to TL^ . The con- 
stant 



d[N] 
d[M] 



Tr 



{sm {pn «) a m-n) Sm^^ (18) 



ensures that the map T is trace-preserving. The state of 
each clone is of the form 



Pi 



7]iN,M)\xJj)('iP\ + [l-7?(iV, M)]- 



(19) 



where is the input state and where the shrinking fac- 
tor is found to be 



V{N,M) 



N M + d 
M N + d 



The corresponding fidelity is 



id) 



N {M~N){N + 1) 
M ^ M{N + d) 



(20) 



(21) 



So this is the optimal fidelity for universal symmetric 
N ^ M cloning of d-dimensional systems. For qubits 
(d = 2) it indeed recovers the Gisin-Massar result ((TB|l . 
For iV = 1 and M = 2, F = ^^TT)- ^^^^ 
a fixed amplification ratio t = the fidelity goes as 
F = 1 - (d - 1) (l - i) ^ -h 0(A^-2) for N ->oo. Con- 
versely, if out of a finite number N of originals one wants 
to obtain an increasingly large number M of clones, the 
fidelity of each clone decreases as F ~ i'^ ^^"^ limit 
M — > oo, in agreement wi t h the results of state estima- 
tion l)Massar and Pooescul IT995jl — more in III. El below. 



good exercise to compute the single-copy fidelity F = 
Tr ((cr ® 1... ® 1) T{u®^\) and recover (ETJ. The first 
step is a symmetrization: denoting a^^'^ the operator that 
acts as cr on the fc-th system and as the identity on the 
others, and replacing T by its explicit form H17|l . we have 



d\M\ 

d\N\ \_ 
d[M] 



fc=i 

M 



Tr [Smi^"'' {ct'^^ ® 1m-jv) Sm) 



where the second equality is obtained using the linear 
and cyclic properties of the trace^^. Now, since cr is a 
projector, cr('=) (cr**^ (g) 1m-n) is equal to cr**^ (g) 1m-n 
for 1 < fc < TV; and is equal to cr«'^+i (g Im^n-i for 
N + 1 < k < M, where the additional cr happens at 
different positions. However, this is not important, since 
the expression is sandwiched between the Sm so it will 
be symmetrized anyway. Using IjlHIl and some algebra, 
one obtains 1^1]) . 



3. Trivial cloning revisited 

We can now have a different look at trivial cloning. 
The "trivial amplification" strategy described in para- 
graph irr.A.ll can be easily generalized to the general case: 
one forwards the original TV particles, adds M — N parti- 
cles prepared in the maximally mixed state and per- 
forms an incoherent symmetrization (i.e., instead of pro- 
jecting into the symmetric subspace, one simply "shuf- 
fles" the particles). The fidelity is then 



FtrUN^M, d) 



N 
M 



M - N 
dM 



(22) 



As expected, Eq. (|21|l shows that the Werner construc- 
tion performs better, but the difference vanishes in the 
limit d ^ oo. We have thus learnt two new insights 
on optimal cloning: (i) it is the quantum symmetriza- 
tion that makes optimal cloning non-trivial, and (ii) in 
the limit of large Hilbert space dimension, trivial cloning 
performs almost optimally. 

In summary, Werner's construction solves the problem 
of finding the optimal universal symmetric QCM for any 
finite-dimensional quantum system and for any number 
of input (N) and output (M > N) copies. We note that 
Werner did not provide the implementation of the QCM 
T as a unitary operation on the system plus an ancilla 
®. This was provided bv iFan et all ll200ll). general- 
izing previous partial results l|Albeverio and Fell l2004t 



2. Calculation of the fidelity 



We have just summarized, without any proof, the 
main results for the optimal universal symmetric iV — s- 
AI QCM with discrete quantum systems. It is a 



Since the trace is linear, we can bring the sum into it, then use 
( o-t'''') Sm = Sm ( 'Ylik ''''''°') ^^'^ finally the cyclic proper- 
ties of the trace. 
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iBuzek and Hillervl Il998(l . In the rest of this Section, 
we move to the study of asymmetric (|11.C|) and state- 
dependent (i.e., non- universal) QCM. 



C. Asymmetric UQCM 1^1 + 1 

Asymmetric universal cloning refers to a situation 
where output clones possibly have different fidelities. 
Here we focus on 1 — > 1 + 1 universal cloning. 
The stud y of more g eneral cases has been undertaken 
recentlv llFiura sck. Fi lip and Cerl 20051 llblisdir et all 
|2004 llblisdir. A cin an d GisinL |2005^ . motivated by the 
security analysis of practical quantum cryptography 
llAcm. Gisin and Scaranil 120041: ICurtv and Liitkenhaud . 
I2004D : we shall present some of these ideas below, 
together with their possible experimental realization 
(IV1.A.2II . 

In t heir comprehensive study of the 1 — > 1 + 1 cloning, 
iNiu a nd Griffiths (1998) had derived, in particular, the 
optimal asymmetric UQCM 1^1 + 1. The same result 



was found independently bv lCerj ^ll99all2000a^ who used 
an alg ebraic approach, and bv lBuzek. Hillerv and BendikI 
l|l998|) who instead developed a quantum circuit ap- 
proach, improving over a previous construction for 
symmetric cloning llBuzek et all Il997|) . Optimality is 
demonstrated by proving that the fidelities of two clones. 
Fa and Fb, saturate the no-cloning inequality^^ 

V{1-Fa){1~Fb) > i - (1 - F^) - (1 - Fb){23) 

The same authors exten ded their constructions beyond 
the q ub it cas e t o any d l|Braunstein. Buzek and Hillervl 
I2OOII: ICerd. l2000b^ . although optimality was 
and was proved only recentb 



only conjectured 

jFiurasek^ili^^n^^er 



llblisdir. Acfn and Gisinl 



was pr oved 
J2005t llblisdir et a.ll 



20051) . 



We review both the Cerf's and the quantum circuit 
approaches, giving the explicit formalism for qubits and 
explaining how this generalizes to any dimension. We 
start with the quantum circuit formalism, which is some- 
how more intuitive. 



1. Quantum circuit formalism 



(A 



(B) 
(M" 









i 























FIG. 2 The quantum circuit used for universal 1 — > 1 + 1 
cloning. For d = 2, all the gates are the standard CNOT. For 
d > 2, the arrows play a role: the arrow towards the right, 
resp. left, defines the transformation \k)\m} |fc)|m-|-fc), 
resp. |A:)|m) \k}\m — k) — as usual, sums and differences 
in the kets are modulo d. 



a quantum information distributor^^, is drawn in Fig. (21 
It uses a single d-dimensional system as ancilla. Let's 
focus on qubits first. For states |cr)^|a;)^|^)^,^ in the 
computational basis, i.e. cr, w,^ G {0,1}, the action of 
the circuit is 

I^>aI^>bIOa/ ^ k + ^ + OAl^ + ^>Bk + OA/(24) 

where all the sums are modulo 2. It is now an easy exer- 
cise to verify that 



H)a\^^)bm 
H)a\^)b\+)m 



IV')aI*+>sm 
\^)b\^^) 



AM 



(25) 
(26) 



where 1$+) - ^(|00) + |11)) and |+) = ^(|0) + |1)). 
Figuratively, one can say that the state of B-M acts as 
the "program" for the "processor" defined by the cir- 
cuit; in particular, \^^)bm ni^kes the processor act as 
the identity on A; |0)^|-|-)jy^ makes the processor swap 
the state into mode B. Now, the optimal asymmet- 
ric QCM follows quite intuitively: just take as an input 
state a coherent superposition of " all the information in 
A" and " all the information in B" : 



BM 



&|0>bI+>m) 



\VIA\"'\^ IBM 
<^H)a\'^^)bM + fe|^)Bl'i'+>AM(27) 



The parameters a and h are real; for the input state of 



B-M to be normalized, they must satisfy a +6 



ib= 1. 



The quantum circuit that is used for universal 1 — > 
-|- 1 cloning in any dimension, which has been called 



This inequality appears in all the meaningful papers with dif- 
ferent notations. For example, in iBuzek and Hillervl il99S|) it 
is Eg. (11) since so,l = 2Fa,b - 1 = 1 - 2(1 - FA,B)T^^i^Q^ 
i2000a^ it is Eq. (6)', since Fa = 1- and Fb = 1- 2x''^. 



This quantum circuit is int eresting beyond the i nterests of quan- 
tum cloning. Specifically, iHillerv et al\ l200'J) have identified 
in it a universal programmable quantum processor. In short, the 
idea is to have a circuit of logic gates coupling an input state with 
an ancilla, such that any operation on the input state is obtained 
by a convenient choice of the ancilla state (the " program" ) . No 
such circuit exists if one requires it to work deterministically; the 
present circuit does the job probabilistically (one knows when the 
operation has succeeded). 
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The partial states for the two clones after the transfor- 
matfon read pa,b = Fa,b\-4^){'iP\ + (1 - FA,B)\ip^){i^^\ 
where the fidelities are 



Fa = , Fb = l-a^/2. 



(28) 



It is easy to verify that these fidelities saturate the no- 
cloning inequality H23|) . As expected, for 6 = (resp. 
a = 0) we find all the information in A, resp. B. The 
symmetric case corresponds to a = 6 = in which 

case we recover the Buzek-Hillery result Fa — Fb ~ |- 

The generalization to d > 2 goes exactly along the 
same lines. The state \'^^) bm now the maximally 
entangled state of two qudits X]fc=o I^)sI^)m' 
state is the superposition^"* -^X]fe=ol^)M- 

ter the transformation, the partial states of the two 
clones read pA — — ('(/'I + h'^'^/d and pB = 

(1 — a^)|V') (^1 + a^l/d, from which the fidelities 



Fa = 1- 



1 



i^73 = 1- 



1 



(29) 



The generalization to d > 2 goes along th e same lines 
l|Cerll2000htlCerf. Bourennane oiIl2002^ . The trans- 



formation, acting on the 
for qudits, reads 



BM 



as defined above 



V 



E 

(m,n)eK 



1) (32) 



where K — {(m, n)|0 < m,n < d — 1} \ {(0,0)}, from 
which the normalization condition + (d^ — l)a;^ = 1, 
and in which the unitary operations Um,n that generalize 
the Pauli matrices are defined as*^ 



U„ 



E 



(33) 



The link with the parameters a and 6 of the quantum 
circuit formalism is provided here by^^ a = w — x, = dx. 



D. State-dependent cloning 

1. Cloning of two states of qubits 



The normalization condition now reads + 5^ + — 1; 
in particular, for the symmetric case we recover Werner's 
result Fa=Fb = afsql) > see Eq. (EJ- 



2. Cerf's formalism 

Cerf's formalism also uses a third c?-dimensional sys- 
tem as ancilla. For qubits, the transformation reads 



lV')^l<i>+) 



BM 



ABM 



y\^)A\'^'')BM (30) 



where 



V = 



vt + X ^ (cTfe (g) cTfe (8) 1) 



k—x,y,z 



(31) 



where the real coefficients v and x must satisfy v^ + 3x^ = 
1 to conserve the norm. Note that V, as written here, 
is not unitary; however, (|30|l defines a unitary transfor- 
mation. In other words, V is the restriction of a uni- 
tary operation when acting on input states of the form 
I'lp) a\^'^) BM- Here lies the appeal of Cerf's formalism: 
the unitary that defines the QCM reduces to the very 
compact and easily written transformation H31|l when 
acting on suitable input states. By inspection, one can 
verify that the state \'^) in the r.h.s. of H30|l is equal to 
(|27|l with the identification a = v — x, b = 2x. In partic- 
ular, the identity is w = 1, a; = 0, the swap is f = .x = ^, 
and the symmetric QCM is = 3a;, that is a; = 



^'^ Written |po) in iBraunstein. Buzek and Hillervl (2] 
Eq. (2.1) in that reference. 



The first study of state-dependent cloning was based 
on a different idea, sim ply, to clone at best two arbitrar y 
pure states of a qubit ijBrufi. DiVincenzo et all Il998|) . 
This is a hard problem because of the lack of symmetry, 
and was not pursued further. One wants to perform the 
optical symmetric cloning of two states of qubits |'0o) and 
IV'i), related by |(V'o|V'i)| = s. The resulting fidelity for 
this task is given by a quite complicated formula: 



-1 + 2,s + 3s2 



(1 - s)Vl - 2s + 9s2 . (34) 

For s = and s = 1, one finds = 1 as it should, be- 
cause the two states belong to the same orthogonal basis. 
The minimum is « 0.987, much better than the value 
obtained with the symmetric phase-covariant doner (see 
below). Oddly enough, this minimum is achieved for 
s = i, while one would have expected it to occur for 
states belonging to mutually unbiased bases (s = ^). 



2. Phase-covariant 1 2 for qubits: generalities 

The best-known example of state-dependent QCM are 
the so-called phase-covariant QCM. For qubits, these are 



In \k + m), the sum i s modulo d. No te also that, in the nota- 
tion of lCerf. Bourenna nc et al.^ 120021) . the transformation 1321 
is written using Um,n ® 1 ® Um,-n instead of Um,,n ® Um,,n ® 1. 
This is indeed the same, since Um,—n = „ and it is well- 
known that U (g) = 1 (g) (7*1$+) holds for the maximally 
entangled state j'l'^). 
° To derive this, replace F = F a given in l28l into Eq. (16) of 
ICerf. Bourennane et oil <2002D . 
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defined as the QCM that copy at best states of the for 



V2 



(|0>+e^^|l)) 



(35) 



These are the states whose Bloch vector lies in 
the equator {x — y) of the Bloch sphere; the 
name " phase-covaria n t" , u sed for the first time by 
iBruf^. Cinchetti et al comes from the fact that 

the fidelity of cloning will be independent of (p. Here 
we restrict our attention to 1 — )■ 2 asymmetric phase- 
covariant cloning for qubits. 

The phase-covariant QCM has a remarkable applica- 
tion in quantum cryptography, since it is used in the op- 
timal incoherent strategy for eavesdropping on the BB84 
protocol, see IIV.B.'2l below. Note that the eavesdropper 
on BB84 wants to gather information only on four states, 
defined by = 0, ^, tt, the eigenstates of ax and ay, 
that is, two maximally conjugated bases. But the two 
problems (cloning all the equator, or cloning just two 
maximally conjugated bases on it) yield the same solu- 
tion. In fact, consider a machine, a CP map T, that 
clones optimally the four states of BB84, in the sense 
that when acting on | ± x) and | ± y) , it gives two ap- 
proximate clones of the form^^ 



T[\±x){±x\] = ri\±x){±x\ + il-7]) 



T[\±y){±y\] = ,/|±2;)(±y| + (l-r,)-. (36) 

Any state in the equator of the Bloch sphere can be writ- 
ten as 

\tp{(p)){'ilj{ip)\ ^ ^{1 + cosipa^ + s'mipay) (37) 

Now, using the linearity of T one can see that T[ax] — 
Tjax and the same holds for ay. Since r(l) = 1, one has 

Tm^)){^{^)\] = + (38) 

for all If. This shows that the optimal cloning of the four 
states employed in the BB84 protocol is equivalent to 
optimally cloning the whole equator of the Bloch sphere. 
A similar argument applies if the z basis is also included: 
to clone all mutually unbiased bases in the Bloch sphere, 
i.e. the states | ± a;), | ± y) and | ± z), is equivalent to 
universal cloning. 



3. Phase-covariant 1 ^ 2 for qubits: explicit transformation 



defin itely impossible for universal cloning l)Durt and DuL 
l2004j) . The QCM is then just part of a two-qubit unitary 
transformation that reads 



|0)|0) 
|1>|0) 



|0)|0) 

cos?/|l)|0) 



sin77|0)|l) 



(39) 



with rj G [O, -1] and we have chosen \R) = |0). Then 
IV'(^))|0) ^(|0)|0)-f cos77e'^|l)|0)-f sinr;e*'^|0)|l)); 
the partial states pA and ps are readily computed, and 
one finds the fidelities 



FT' = ^(1 



cosTy) , F'b y = i(l + sinr;).(40) 



As desired, these fidelities are independent of (p. It is 
easily verified numerically that this QCM is better than 
the universal one for the equatorial states: one simply 
fixes Fa = Fa~^ ^^'^ verifies that > Fb, where 

Fb is given in H28|) . In particular, for the symmetric case 
7? = f , one has F^J = i(l + ^) ~ 0.8535 > |. 

Niu and Griffiths introduced the two-qubit QCM in the 
context of eavesdropping in cryptography. It was later re- 
alized t hat a version with anc i lla of t he phase-covariant 
QCM ^Brufi. Cinchetti et all HHS ICriffiths a,nd Nhl 
Il997f) . while equivalent in terms of fidelity of the 
clones on the equator, i s generally more suited f or the 
task of eavesdropping llAcin Gisin and Scaranl 120041: 
lAci'n et a/.Ll2004HDurt and Dul . 120041. This machine can 
be constructed by symmetrizing H39() with the help of an 
ancilla qubit as follows: 



|0)|0)|0) 
|1)|0)|0) 
|0)|1)|1) 

ll>ll>ll> 



|0)|0)|0) 

cos77|l)|0) + sin77|0)|l)) |0) 

cos77|0)|l) + sin77|l)|0)) |1) 

DIDIl) 



(41) 



and letting this unitary act on the input state 
W a\^~^) B M ■ This reminds Cerf's formalism, and in- 
deed the unitary acts on W a\^^) BM opera- 
tor (|Cerill2000H) 

V ^ F Iabm + (1 - F)a, (g)a,(g)l 

+ v/F(1 - F) {ax ax + ay ay) 1 (42) 

where F = F^ ^ . Notice again how Cerf's formalism 
appeals to intuition: it is manifest in (|42|) that the x — y 
plane is treated differently from the z direction. For a 
practical illustration of the use of the phase-covariant 
QCM for eavesdropping in cryptography, we refer the 
reader to paragraph IIV.B . 2l below. 



The task of copying at best the equator of the Bloch 
sphere, even in the asy mmetric case, can be accom- 
plished without ancilla (^Niu and Griffith^ Il999() ; this is 



^'^ Notice that it is assumed here that the cloning process only 
shrinks the Bloch vector of the initial input state. 



4. Other state-dependent QCIVI 

Most of the state-dependent QCM that have been stud- 
ied are generalizations of the phase-covariant one, often 
called phase-covariant as well. The idea is to clone at 
best some maximally conjugated bases. Specifically, the 
following state-dependent doners have been studied: 
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• Asymmetric 1 — > 2 phase-covariant QCM, that 
clones at best tw o maximally conjugated bases 
in any di i nensio n l)Cerf. Bou Tgnngiig_g|_gZj^j2Q^ ; 
Fan et allEoO^ . For d = 3 (ICe rf, Durt an d Gisin , 
2002() and d = 4 l)Durt and Naeler. 1003), asym- 
metric 1^2 QCM have been provided that clone 
three or four maximally conjugated bases. For any 
d, the symmetric QCM that are optimal for cloning 
" real quantum states" — that is, a basis and all the 
states obtained from it using SO{d) — have been 
found; optimality has b een demonstrated usin g the 
no-signaling condition ijNavez and CerAl2003|) . 

• Symmetric N M phase-covariant QC M for ar- 
bitrary dimension fBuscemi et al!, '2005*) , general- 
izing previous results (D'Aria no and M acchiavcllo, 
l2003|) . In particular, machines have been found 
that work without ancilla ("economical QCM") 
thus generalizing the Niu-GrifSths construction 
given above H39|l — which, however, provides also 
the asymmetric case. 

• Not relate d to phase-covariant cloning: 
■Fiurasek et al . (2002) have studied the cloning of 
two orthogonal qubits. It is known that, for the 
task of estimating a direction n, the two qubit 
state | n, — n) gives a bette r estim ate than the state 

()Gisin and Popescul [l999(l . For cloning, the 
task is to produce M clones of |n) starting from 
either of those two-qubit states. For M < 6, better 
copies are obtained when starting from |ri, ~n). 

• Finally, another issue that has been discussed 
is the optimal clonin g of entangled states 
l)Lamoureux et a/.L l2004j) . 



E. Quantum cloning and state estimation 

One could anticipate that there might exist a strong 
relation between cloning the state of a quantum system 
and acquiring knowledge about this state. After all, there 
is a strong analogy between the two processes. In both 
cases, the (quantum) information contained in the in- 
put is transferred into some " larger" system: the output 
clones in the case of cloning, and the measuring device 
in the case of state estimation. In this section, we shall 
see that there is mor e than a mere aiialogy. In fact, 
as first appreciate d bvlGi sin and Massad ll l997l) and fur - 
ther elaborated bvlBruB. Ekert and Macchiavelld l|l998fl : 
(i) There is an equivalence between optimal universal 
iV — > cx) quantum cloning machines of pure states and 
optimal state estimation devices taking as input N repli- 
cas of an unknown pure state, (ii) Bounds on optimal 
cloning can be derived from this equivalence. We are 
going to present these results. To simplify the presenta- 
tion, we shall only consider universal cloning of qubits, 
but the subsequent analy s is can be generalized, without 
difficulty, to qudits l)Kevil2002(l . 



The equivalence between optimal universal symmetric 
cloning and state estimation can be established using the 
notion of shrinking factor, already introduced for doners. 
Indeed, we stressed in paragraph lll.Bl that the quality of 
the optimal N ^ M UQCM is fully characterized by its 
shrinking factor ri{N, M): if the input state to clone reads 
P'm ~ then the individual state of each output 

clone reads r]{N, M)\ip){tp\ + {1 - r]{N,M))^. A similar 
structure arises in the case of state estimation. Given 
N copies of an unknown qubit state there exists an 
optimal POVM (Positive-Operator- Valued Measure) 

P^.>0 , Y^^t-^^^ (43) 

which^^ yields the best pos sible estimate of tl> tak ing the 
fidelity as figure of merit ijMassar and Popescul 0>995). 
To each measurement outcome fi, a guess \^pfJ,) of the 
input state is associated. During one instance of the 
state estimation experiment, the outcome fj, can appear 
with probability tTP^\Tp){ip\ — Pfj.i'ip). Thus, on av- 
erage, the POVM yields th e estimate Ppgt('0) = 
^„ p ^('0)|'0^) It turns out ijMassar and Popescul 

Il99fj) that this average estimate can be written as 

V*{Nm{^j\ + {l-V*{N))^, (44) 

and the average fidelity of the state estimation is thus 
given by (1 -I- r]a.{N))/2. In turn, the performance of the 
POVM that describes the best state estimation can also 
be characterized by a shrinking factor 77* (N) . 

We can now state precisely what we mean when stating 
that there exists an equivalence between optimal iV — > cx3 
quantum cloning machine and an optimal state estima- 
tion device. We have 

r]4N) = r]{N, 00). (45) 

This relation tells us that using N qubits identically pre- 
pared in the state to estimate ip or to prepare an 
infinite number of clones of {ip) (and then infer an es- 
timate of V) are essentially equivalent procedures: the 
amount of information one can extract about the input 
preparation is the same in both cases. 

To prove Eq. (|^ , we shall show that both ??*(iV) < 
ri{N, 00) and ry* (N) > r]{N, 00) hold. The first of these in- 
equalities is almost obvious. Consider a — > M cloning 
procedure in which we first perform state estimation on 
the N input originals, and then prepare M output clones 
according to the (classical) outcome we get. If the in- 
put state is , then, on average, the state of each 



Note that the elements of the POVM sum up to the projector 
Sjv onto the symmetric subspace Ti.^, and not to the identity. In 
fact, one can "complete" the POVM with the operator 1 — 5]v, 
but the corresponding outcome will never be observed because 
the input state belongs to Ti.^. 
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clone will be of the form (|44() , and thus characterized by a 
shrinking factor rj^, (N). By definition, such a cloning pro- 
cedure cannot be better than using an optimal N M 
quantum cloning machine. Thus ri^(N) < ri{N,M) for 
all M, and in particular 77* (iV) < r]{N, 00). 

To prove the second inequality, 77* (A^) > ri{N, 00), we 
shall conversely consider a situation in which we want to 
achieve state estimation from N input originals with an 
intermediate cloning step. Let us remark that the output 
of an optimal N ^ M U QCM b elongs to the sy mmetric 
subspace Ti:^^. Therefore ijBrufi. Ekcrt and Macch lavellol 

Il998|) . for any input state \^)^^ , the output state can 
be written as a pseudo-mixture 



(46) 



that is X^jO^il^) ^ 1 t>ut the coefficients may 



be negative. Also, from \ipi){')pi\ 



(S)M 



our optimal 



state estimation device yields (on average) the estimate 
ri^{M)\tp,) {ip,] + {1- ?7*(M))|-. Thus, by linearity, our 
estimation procedure yields the estimate 

Pest = E"*(^) U{M)\A){iJ^\ + (1 - V4M))^ 

i ^ 

Clearly, = ry(iV, M)|V') (^Al + (1 - 

r]{N, M))^. By definition, this state estimation scheme 
cannot outperform an optimal state estimation on the N 
input originals. Thus r]{N, M)r]^{M) < t]^{N). From 
the fact that in the limit of large M states estima- 
tion can be accomplished p erfectly, limM-^00 ?7*(M) = 1 
l|Massar and Popescui Il99,'^ . we deduce that ri{N, 00) < 
r/* (A'') . This concludes the proof of Eq. . 

We are now in a position to further connect quantum 
cloning and state estimation. Starting from (|45|l . we can 
show that a limit on the quality of ^ M cloning can be 
derived from state estimation, modulo one assumption: 
the output state of an ^ M cloning machine should be 
supported by the symmetric subspace Ti-Xi- To establish 
such a limit, our first task is to prove that the shrinking 
factors of two cascaded doners multiply. Let us construct 
an N L cloning machine by concatenating an A^ ^ M 
machine with an Al L machine, and let such a cloning 
machine act on some input state . Since the output 
state of the first doner is assumed to be supported by 
TY^j, it admits the decomposition (|46|) . Processing this 
output state into the second cloning machine yields 



where Plii'^M3) ii^j 



?7(M,L)|V'.)(^. 



(47) 



(1 - 



r]{M,L))^. Thus the individual state of each 
clone at the output of the second doner reads 
T]{N,M)T]iM,L)\iP){il^\ + (1 - f]{N,M)r]{M,L))^. Of 
course, this cloning in stage cannot be better than di- 
rectly using an optimal N ^ M doner. Thus 

Tj{N,M)7j{M,L) < rj{N,L). 



In particular, r]{N, M)ri{M, 00) < i]{N, 00). Using 
Eq. H45|) . we deduce the important relation 



viN,M) < 



(48) 



From r]^{N) = N/{N + 2) l|Massar and PopescuL IT99I . 
we find 



r){N,M) < 



N M + 2 
M N + 2 



(49) 



Comparing with (|2()|l . we see that, perhaps not so surpris- 
ingly, this last inequality is saturated by optimal UQCM. 

The foregoing analysis establishes a precise connec- 
tion between optimal cloning and optimal state estima- 
tion, valid when one considers all possible pure states 
of qubits — - in fact, it extends to all pure states of 
qudits for any d — and looks like a miracle. One 
could argue that the main reason why this connec- 
tion appears is that the output state of an optimal 
N M cloning machine turns out to be supported 
by the symmetric subspace Ti-^j, the crucial ingredi- 
ent in deriving H45|l and (|48() . But this latter fact, 
although established on a firm mathematical ground 
l|Kevl and Werneil Il999l) is still lacking a physical inter- 
pretation. A recent result has come to strengthen this 
connection: it has b een proved llFiurasek. Filip and Cerl 
l2nn,'^lTb]isdir e.t ffi.Ll2f)nllTblisdir. Ar.fn and CisinLl2nn,'j^ 
that the optimal asymmetric 1 ^ 1 -I- A^ UQCM, in 
the limit A^ — s- 00, achieves the optimal "disturbance 
vs. gain" trade-off for the measurement of one qubit 
ijBanaszekl l200l|) . 

One might wonder if the connection between state esti- 
mation and cloning holds in general. To our knowledge, 
the question is still open. It certainly deserves further 
investigation, for answering it would allow to understand 
whether the neat relation between cloning and state es- 
timation is a fundamental feature of quantum theory or 
a mere peculiarity of the set of all pure states of qudits. 



III. CLONING OF CONTINUOUS VARIABLES 

This Section reviews the issue of approximate cloning 
for continuous variable systems (or quantum oscilla- 
tors). Our analysis will be focussed on A^ ^ M 
Gaussian machines, cloning equall y well all coher- 
ent states fBraunstein etai, 2001; Cerf and Iblisdid, 
2OOOI: fCerf. Ipe and Rotte nbcrg. 2000,; Fiurasek , 2flj3^ 



LindbladLl200nir The optimality of such machines will be 
investigated. Upper bounds on the minimal amount of 
noise the clones should feature will be derived for qubits 
(|III.A|) via a connection with quantum estimation the- 
ory, using techniques similar to those we have presented 
in paragraph llI.EI Then we shall present transformations 
achieving these bounds (jlll.Bp . Finally, we shall briefly 
discuss possible variants of our analysis ljIII.C|l . 
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A. Optimal cloning of Gaussian states 

1. Definitions and results 

The Hilbert space associated with a quantum osciUator 
is H = L^(R), and is infinite-dimensional. Let us first 
consider what we can get from asking for universahty in 
such a Hilbert space. Considering the limit for d —^ oo 
of Eq. (|^ . we see that 



copied can be computed using Eq. (|53() and the identity 
|(a|a')P = exp(— |a — a'P). One finds 



IN,M 



{a\pi\a) = 



(54) 



' N,M 



We shall prove in the following paragraphs that a lower 
bound on the noise variance ct^ j^j is given by 



lim F] 



id) 



N 



(50) 



where N is the number of input replicas, and M > N 
the number of clones. Moreover, this limit can also be 
reached by trivial cloning, see III. B. 31 Can we then do 
better than Eq. H5U|) , by dropping the requirement of uni- 
versality or taking a different perspective? After all, in 
some circumstances such as quantum cryptography, it is 
natural to consider doners which are optimal only for a 
subset of states S C H. Also, the fidelity is not always 
the most interesting figure of merit to consider. 

Here, we shall concentrate on the situation in which we 
only want to clone the set of coherent states, denoted S. 
Let X and p denote two mutually conjugated quadratures 
of a harmonic oscillator, [x,p] = i {h = 1). The set of 
coherent states is the set of states that satisfy 



Ax' = 



= Ap2 ^ {f) - ^ 1/2, (51) 



and can be parametrized as 



S = 



V2 



ip), x,p eR 



(52) 



where (a|a;|a) = x and (a|p|a) = p. We shall consider 
N ^ M symmetric Gaussian doners (SGC). These don- 
ers are linear, trace-preserving, completely positive maps 
C outputting M clones from N < M identical repli- 
cas of an unknown coherent state |a). To simplify the 
analysis, we require that the joint state of the M clones 
C{\a) {a]"^^ ) be supported on the symmetric subspace of 
■^(giM g^^^ such that the partial trace over all output 
clones but (any) one is the bi-variate Gaussian mixture: 

pi{a) = TrM-iC{\a){a\'^^) 

d2/3e-l'5|'<'^i:>(/3)|a) (a|L'^(/3) (53) 



'N,M 



where the integral is performed over all values of f3 — {x+ 
ip)/^/2 in the complex plane {H = 1), and the operator 
D{f3) — exp(/3a^ — /3*a) achieves a displacement of x in 
position and p in momentum, with d = -y=[x + ip) and 



(£ — ip) denoting the annihilation and creation 
operators, respectively. Thus, the copies yielded by a 
SGC are affected by an equal Gaussian noise crl = cTp — 
aff j^^.j on the conjugate variables x and p. The fidelity of 
the optimal N ^ M SGC when a coherent state |a) is 



' N,AI 



1 

N 



1 



(55) 



implying in turn that the optimal cloning fidelity for 
Gaussian cloning of coherent states is bounded by 



MN 



Tn.m 



MN +M- N 



(56) 



Thus, all coherent states are copied with the same fidelity 
— recall that this property does not extend to all states 
of TC. One can also check that Eqs (|55|l and H5t)|l fulfill 
the natural requirement that the cloning fidelity increases 
with the number of input replicas. At the limit N ^ oo, 
we have /n.m 1 for all M, that is, classical copying 
is allowed. Finally, for M — > oo, that is, for an optimal 
measurement, we get /n.m N/ {N + 1). 

It is worth noting that the optimal cloning of squeezed 
states requires a variant of these SGCs. For instance, 
the best symmetric doner for the family of quadra- 
ture squeezed states with squeezing parameter r must 
have the form of Eq. H53|l . but using the definition 
(i — + iKp)/y/2 with K — exp(r). These doners nat- 
urally generalize the SGCs and give the same cloning 
fidehty, Eq. (|^ . for those squeezed states. 



2. Proof of the bounds for 1 ^ 2 cloning 

Let us first prove (|55|l in the simplest case {N, M) — 
(1,2). This case is interesting to single out because it 
demonstrates the link between quantum cloning and the 
problem of simultaneously measuring a pair of conjugate 
observables on a single quantum sys tem. Our starting 
point is thus the relation derived bv lArthurs and Kellvl 
l)l965j) . which constrains any attempt to measure x and 
p simultaneously on a quantum system: 



al{l)al{l)>\, 



(57) 



where cr^(l) and <t^{1) denote the variance of the mea- 
sured values of x and p, respectively, when simultane- 
ously measuring x and p on some quantum state p. 

It is crucial to clearly distinguish between the Arthurs 
and Kelly relation H57|) . and the Heisenberg uncertainty 
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relation^^: 

Ax^Ap^ > 1/4, (58) 

where Ax^ (resp. Ap^) are intrinsic variance of the ob- 
servables x (resp. p) for any quantum state p. The 
Heisenberg relation is vaHd independently from any mea- 
surement performed on the state p; in particular, it holds 
even if we have a perfect knowledge of the state p. In con- 
trast, the trade-off between the information about x and 
the information about p, that one can acquire during a 
single measurement on the state p, is quantified by the 
Arthurs-Kelly relation (|57|l . In particular, the best pos- 
sible simultaneous measurement of x and p with a same 
precision satisfies cr^(l) = o'p(l) = 1. Compared with 
the intrinsic noise of a coherent state Ax^ — Ap^ = 1/2, 
we see that the joint measurement of x and p effects an 
additional noise of minimum variance 1/2. 

Now, let a coherent state |a) be processed by a 1 ^ 2 
SGC, and let x be measured at one output of the doner 
while p is measured at the other output. This is a way of 
simultaneously measuring x and p, and as such it must 
obey the Arthurs-Kelly relation (|S7jl . Consequently, the 
intrinsic variances of the observable x and p in the state 
Pi{a), denoted respectively as Sx and Sp, must fulfill 

6x^ 6f >1. (59) 

Using Eq. we get 

(Ax^ + al^){Af + al^) > I. (60) 

Now using Eq. I)58|l . we conclude that the noise variance 
is constrained by 

al^ > = 1/2, (61) 

thus verifying Eq. ifS^ in the case {N,M) = (1,2). 

A similar argument can be used to characterize the out- 
put copies of an asymmetric quantum cloning machine, 
in which the qualities of the clones are not identical and 
in which one might desire that the added noise due to 
cloning is different for both quadratures. Using, Eq. (|57|l . 
one easily shows that the following relations hold: 

'^lA > 1/4, (62) 
4.i<2 > 1/4, (63) 

where i (resp. cr^ i) refers to the added x quadrature 
(resp. p quadrature) added noise for the first clone, and 
where tr^ 2 ^.nd Cp 2 ^^'^ defined likewise. These cloning 
uncertainty relations are useful when assessing the secu- 
rity of so me continuous variables quantum c ryptographic 
schemes (jCerf. Lew and van AsschS l200l|) . 



In this paper, we adopt the usual notation AA for the intrinsic 
variance of the observable A, and use 5A for other variances in 
Eq. I59i . Obviously, SA > A A; this is what motivates the use 
of the opposite convention in the papers on cloning that we are 
reviewing here. 



3. Proof of the bounds for — > M cloning 

Let us now prove Eq. H55I) in the general case. Our 
proof is connected to quantum state estimation theory 
similarly to what was done for quantum bits in paragraph 
III.EI The key idea is that cloning should not be a way 
of circumventing the noise limitation encountered in any 
measuring process. More specifically, our bound relies, 
as in the discrete case, on the fact that cascading an 
N ^ M doner with an M — > L doner results in a ^ L 
doner which cannot be better that the optimal N L 
doner. We make use of the property that cascading two 
SGCs results in a single SGC whose variance is simply 
the sum of the variance s of the two component SGCs 
l)Cerf and Iblisdiil l2000l) . Hence, the variance ct^ of 
the optimal N ^ L SGC must satisfy 

CT^,L < Cr^,M + C^l/.L- (64) 

In particular, if the M L doner is itself optimal and 

L — !■ CXD, 

'^N,oo < <^N,M + '^\loo (65) 

As for the discrete case, in the limit M — > 00, estimators 
and quantum cloning machines tend to become essen- 
tially identical devices. Thus Eq. (|65|l means that cloning 
the N replicas of a system before measuring the M re- 
sulting clones does not provide a mean to enhance the 
accuracy of a direct measurement of the N replicas. 

Let us now estimate CTatco, that is, the variance of 
an optimal joint measurement of x and p on N replicas 
of a system. From quantum estimation theory ijHolevd . 
I1982D . we know that the variance of the measured values 
of X and j5 on a single system, respectively (7^(1) and 
CTp(l), are constrained by 

9xO-l{l) + gpcr^il) > gxAx^ + gpAp^ + ^gx9p (66) 

for all values of the constants gx,gp > 0. Note that, for 
each value of g^ and gp, a specific POVM based on a 
resolution of identity in terms of squeezed states, whose 
squeezi ng A is a fun ction of gx and 5^, achieves this 
bound l)Holevo[ Il982() . Squeezed states satisfy Ax^ = 
K^/2 and Ap^ = 1/2k^. Moreover, when a measurement 
is performed on N independent and identical systems, 
the r. h. s. of i s redu c ed by a factor N~^, as in clas- 
sical statistics (Hdstroml Il976j) . So, applying N times 
the optimal single-system POVM is the best joint mea- 
surement when N replicas are available since it yields 
al{N) = N-^ctI{1) and a^{N) = N-^a^{l). Hence, us- 
ing Eq. for a coherent state (Aa;^ = Ap"^ ~ 1/2) and 
requiring tr^ (N) = a"^ (N) , the tightest bound is obtained 
for gx = gp- It yields 

^%,oo = 1/^, 

which, combined with Eq. H65|) . gives the minimum noise 
variance induced by cloning, Eq. (|55|l . 
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B. Implementation of Gaussian QCMs 

Now that we have derived upper bounds on optimal 
cloning, we shall show that these bounds are achievable, 
and exhibit explicit optimal cloning transformations. Re- 
markably, these transformations have a fairly simple im- 
plementation, when the quantum oscillator corresponds 
to a light mode: it requires only a phase-insensitive lin- 
ear amplifier and a network of beam splitters^° . We shall 
also discuss the link between the issue of optimal quan- 
tum cloning and that of optimal amplification of quan- 
tum states. 



1. Definitions and requirements 

Let us first state what we expect from a quantum 
cloning machine. Let |^) = \af^ ® ^q^m-n ^ ^^^^ 
denote the initial joint state of the TV input modes to 
be cloned (all prepared in the coherent state la)), the 
additional M — N blank modes, and an ancillary mode 
z. The blank modes and the ancilla are assumed to be 
initially in the vacuum state |0). Let {xk,Pk} denote the 
pair of quadrature operators associated with each mode k 
involved by the cloning transformation^^. A: = ... — 1 
refers to the N original input modes, and k = N . . . M —1 
refers to the additional blank modes. Cloning can be 
thought of as some unitary transformation 



u : n 



(giAf+l 



I*) 



U\^) 



Alternatively, in the Hcisenberg picture, this transfor- 
mation can be described by a canonical transformation 
of the operators {xk,Pk}'- 



(67) 



We work in the Heisenberg picture because cloning turns 
out to be much simpler to study from that point of view. 
We now impose several requirements on the transforma- 
tion Eq. (|67|l that translate the expected properties for 
an optimal cloning transformation. 

First, we require the M output modes quadratures 
have the same mean values as the the input mode: 



{xl)^{^\xo\4>). fc = O...M-l, (68) 
(pIO - (^bolV'), A: = 0...M-1. (69) 



This means that the state of the clones is centered on the 
original coherent state. Our second requirement is covari- 
ance with respect to rotation in phase space. Coherent 
states have the property that quadrature variances are 



Note that another implementation, with the same performances, 
involving a circuit of C-NOT gates has also been proposed 
JCerf. Ipe and Rottenberd. l200cl) . 

In what follows, we sometimes omit the hats on operators when 
the context is clear. 



left invariant by complex rotations in phase space. That 
is, for any mode k involved in the cloning process and 
for any operator Vk — cxk + dpk (where c, d are complex 
numbers satisfying |cp + jdp = 1), we have: 



(vl) - (vkf = vacuum fluct. 1/2. (70) 



We impose this property to be conserved through 
the cloning process. Taking optimality into account, 
Eq. H55|) . rotation covariance yields: 



,1 1 



1 



(71) 



where v'^ = cx'^ + dp'^. 

The third requirement is, of course, the unitarity of 
the transformation. In the Heisenberg picture, unitarity 
translates into demanding that th e commutatio n rules be 
conserved through the evolution jCaveaLlTosl : 



',xk"]^w',pn^o, [x/',pk"] 



(72) 



2. Optimal Gaussian 1^2 QCIVl 



Let us first focus on duplication {N — 1,M = 2). A 
simple transformation meeting the three conditions men- 
tioned above is given by: 



Xl Xz 
Xl Xz 

V2 V2' 

x'z = Xo + V2Xz, 



Xo 

xo 



Po = Po + 
Pi =Po- 
P'z = -Pa 



Pi Pz 
V2 ^/2' 

Pi Pz 

V2 ^/2' 
+ ^Pz. (73) 



This transformation clearly conserves the commutation 
rules, and yields the expected mean values {{xo),{po)) 
for the two clones (modes 0" and 1"). One can also 
check that the quadrature variances of both clones are 
equal to 1, in accordance with Eq. (|71|l . This transfor- 
mation a ctually coincides with the c loning machine intro- 
duced bv lCerf. Ipe and Rottenber3 (|2p00). Interestingly, 
we note here that the state in which the ancilla z is left 
after cloning is centered on [xq, —po), that is the phase- 
conjugated state I a). This means th at, in analogy with 
the u niversal qubit cloning machine l|Buzek and Hillervl 
I1996D . the continuous-variable doner generates an anti- 
clone (or time-reversed state) together with the two 
clones. 

Now, let us show how this duplicator can be imple- 
mented in practice. Eq. ]T6\i can be interpreted as a 
two-step transformation: 



V2ao 
1 



V2 



(flQ-l-ai), a'l 



1 



- V2a„ 
K - ai)- 



(74) 



As shown in Fig.|Sl the interpretation of this transforma- 
tion is straightforward: the first step (which transforms 
flo and Qz into Oq and a'z) is a phase- insensitive amplifier 
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whose (power) gain G is equal to 2, while the second step 
(which transforms Oq and ai into Cg and a") is a phase- 
free 50:50 beam splitter. Clearly, rotational covariance is 
guaranteed here by t he use of a p hase-insensitive ampli- 
fier. As discussed bv lCave^ l)l982i') . the ancilla z involved 
in linear amplification can always be chosen such that 
(uz) = 0, so that we have (qq) = (a") = (ao) as required. 
Finally, the optimality of our doner can be confirmed 
from known results on linear amplifiers. For an amplifier 
of gain the quadrature variances of are bounded by 
l|CavesL 11982^ : 



> (G-l)/2. 



(75) 



Hence, the optimal amplifier of gain G — 2 yields cr^ = 
1/2, so that our cloning transformation is optimal ac- 
cording to Eq. (|55|l . 

Ancilla Vacuum 



Clone 1 



Anti-clone Clone 2 

FIG. 3 Implementation of the optimal Gaussian 1^2 QCM 
for light modes. LA stands for Linear Amplifier, and BS rep- 
resents a balanced Beam Splitter. 




3. Optimal Gaussian N ^ M QCM 

Let us now derive an iV — s- M cloning transformation. 
To achieve cloning, energy has to be brought to each of 
the M — N blank modes in order to drive them from 
the vacuum state to a state which has the desired mean 
value. We shall again perform this operation with the 
help of a linear amplifier. From Eq. H75|l . we see that 
the cloning induced noise essentially originates from the 
amplification process, and grows with the gain of ampli- 
fier. So, we shall preferably amplify as little as possible. 
Loosely speaking, the cloning procedure should then be 
as follows: (i) concentrate the N input modes into one 
single mode, which is then amplified; (ii) symmetrically 
distribute the output of this amplifier amongst the M 
output modes. A convenient way to achieve these concen- 
tration and distribution processes is provided by the Dis- 
crete Fourier Transform (DFT). Cloning is then achieved 
by the following three-step procedure (see Fig. 0}. First 
step: a DFT (acting on N modes). 



1 



^ exp{ikl2Tr/N) ai, 



(76) 



Blank 

Blank 
Input N-1 

Input 1 
Input 

Ancilla 



DFT 



LA 



DFT- 



3 

O 



Anti-clone 



FIG. 4 Implementation of the optimal Gaussian N ^ M 
QCM for light modes. LA stands for Linear Amplifier, DFT 
for Discrete Fourier Transform. 



with fc = . . . TV — 1. This operation concentrates the en- 
ergy of the N input modes into one single mode (renamed 
ao) and leaves the remaining iV — 1 modes {a'^ . . . a^v-i) 
in the vacuum state. Second step: the mode ao is am- 
plified with a linear amplifier of gain G = M/N. This 
results in 



r 

a. 




(77) 



Third step: amplitude distribution by performing a DFT 
(acting on M modes) between the mode Oq and M — 1 
modes in the vacuum state: 



1 



M-l 



'M 



^ exp{ikl2n/A4) aj, 



(78) 



(=0 



with fc = . . . M - 1, and a ■ = ai for i = iV . . . A/ - 1. 
The DFT now distributes the energy contained in the 
output of the amplifier amongst the M output clones. 

It is readily checked that this procedure meets our 
three requirements, and is optimal provided that the am- 
plifier is optimal, that is al^ = [{M/N) - l]/2. The 
quadrature variances of the M output modes coincide 
with Eq. H55() . As in the case of duplication, the qual- 
ity of cloning decreases as increases, that is am- 
plifying coherent states, or cloning them with the same 
error for each clone, are two equivalent problems. For 
1 — > 2 cloning, we have seen that the final amplitude 
distribution amongst the output clones is achieved with 
a single beam splitter. In fact, any unitary matrix such 
as the DFT used here can be realiz ed with a sequenc e 
of beam splitters and phase shifters ijReck et a/J . ll99^ . 
This means that the N ^ M cloning transformation 
can be implemented using only passive elements except 
for a single linear amplifier. An explicit sequence of 
beam splitters achieving a DFT on M modes is given 
by Braunstein et al. (2001). 

Finally, we note that, if squeezed states are put in 
rather than coherent states, the transformations and cir- 
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cuits presented here maintain optimum cloning fideli- 
ties, provided all auxiliary vacuum modes (the blank 
modes and the ancillary mode z) are correspondingly 
squeezed. This means, in particular, that the ampli- 
fier mode z needs to be controlled which requires a de- 
vice different from a simple phase- insensitive amplifier, 
namely a two-mode parametric amplifier. One can say 
that the cloning machine capable of optimum cloning of 
all squeezed states with fixed and known squeezing then 
operates in a non-universal fashion with respect to all 
possi ble squeezed states at the input (|Ccrf and Iblisdir. 
l200nD . 



C. Other continuous variable QCMs 

We conclude this Section by summarizing some inter- 
esting developments in continuous variable cloning. 

Other figures of merit.- The universal Gaussian ma- 
chines presented in llll.Al and llll.Bl have been derived re- 
quiring that the noise of the output clones be minimum. 
But, one could have used other figures of merit to judge 
the quality of the output clones. Then, would we have 
obtained different solutions? Another related issue is: do 
we get better doners if the Gau ssian assumption is re- 
laxed? ICerf. Kriiger et all (|200,^ have proved that if one 
chooses the global fidelity^^ as the figure of merit, then 
the universal Gaussian doner turns out to be optimal too. 
But surprisingly, the Gaussian assumption is too restric- 
tive if the goal is to optimize the single-clone fidelity. For 
instance, for 1 — > 2 cloning, there exists a non-Gaussian 
operation whose output clones have a fidelity of 0.6826 
with the original for all coherent states, improving on the 
universal Gaussian machine, which achieves a fidelity of 
2/3 « 0.6666, see Eq. 

Optimal cloning for finite distributions of coherent 
states. - In devising optimal cloning machines, we require 
that all coherent states be cloned with an equal qual- 
ity. In other words, we devised cloning machines which 
are optimal for a distribution of coherent states in phase 
space which is flat. But, for practical reasons, it is in- 
teresting to consider situations where the coherent states 
to be cloned are produced according to a finite distri- 
bution over phase space — in other words, to drop the 
requirement of universality over all coherent sta tes. In 
parti cular, the case has been studied ( Cochra ne et al\ . 
12004 iGrosshanst 12002) in which the coherent states to 
be cloned are produced according to a Gaussian distri- 
bution 

Pia) = ^^''"''/'"^^ • (79) 



Global fidelity was introduced in 111. B. II for the case of discrete 
variables. Recall that in that case, the optimization of the global 
and of the single-copy fidelity leads to the same optimal UQCM. 



It is easily seen that in this setting, the cloning proce- 
dures we have considered so far do not produce clones 
with optimal fidelities. For instance, if P{a) is a suffi- 
ciently peaked distribution, then a very trivial cloning 
machine, from which the first output clone is the unaf- 
fected original and the second clone is a mode prepared in 
the vacuum state, already achieves better fidelities than 
the universal Gaussian doner. Actually, one can prove 
that for all values of S, there is a cloning machine achiev- 
ing a single-clone fidelity of 

^1 - , 1 (80) 

(3-2V2)S2+l' ^ - 2 

Interestingly, such a cloning machine can be achieved 
using the setup shown in Fig. |31 but where the gain is 
adapted to the distribution of coherent states: 

(2S2 + 1)2 ■ 

IV. APPLICATION OF QUANTUM CLONING TO 
ATTACKS IN QUANTUM CRYPTOGRAPHY 

A. Generalities 

As stated in the introduction, the relationship between 
the no-cloning theorem and the security of quantum cryp- 
tography was already pointed out in the first protocol 
(Bennett and Brassard, 198 J). Let us briefiy sketch here 
the common structure be hind any pr o tocol: we refer the 
reader to the review by iGisin et al\ ()2002() for a more 
thorough view on quantum cryptography. A sender, Al- 
ice, encodes some classical information on a quantum 
state, chosen among a set of non-orthogonal alternatives 
{IV'i}^}. The so-prepared particle goes to a receiver. 
Bob, who randomly chooses a measurement from a pre- 
established set of measurements. When more than two 
states are used for the encoding, the exchange of the par- 
ticles is usually followed by a "sifting" phase, in which 
Alice reveals something of the encoding (e.g. the basis 
to which each state belongs) , allowing Bob to know if he 
has done the good measurement. After this process, Alice 
and Bob share a list of classically correlated symbols. Us- 
ing well-established techniques from classical information 
theory, this list can be transformed into a secret key^'^, 
which is later consumed for sending private information 
by means of the one-time pad. So quantum cryptography 
is actually quantum key distribution (QKD). 



Actually, when discrete-level quantum states are used, one nor- 
mally tailors the protocol in such a way that, in the absence of 
an eavesdropper and of errors, the correlation between Alice and 
Bob is perfect without any classical processing, i.e. it already 
constitutes a perfect secret key. However, this can no longer be 
done for protocols using continuous variables. 
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Although everything that takes place in Alice and 
Bob's sites is secure^^, this is no longer the case for the 
channel connecting them. This means that an eavesdrop- 
per, usually called Eve, can freely interact with the states 
while they propagate and try to extract information. Eve 
is allowed to perform the most general action consistent 
with quantum mechanics. In particular then, she is lim- 
ited by the no-cloning theorem: contrary to what happens 
for classical information that can be amplified at will, 
when Eve obtains information on the state sent by Al- 
ice, the state used for the encoding is perturbed and she 
introduces errors. The larger the information obtained 
by Eve is, the more the state is perturbed, and conse- 
quently the larger is the error rate in the correlations 
between Alice and Bob. 

In fact, QKD is secure because one of the following 
cases happens: either the error rate observed by Alice 
and Bob is lower than a critical value Dc, in which case a 
secret key can be extracted using techniques of classical 
information theory; or the error rate is larger than Dc, 
in which case Alice and Bob throw their data away and 
never use them to encode any message. In other words, 
the eavesdropper can either lose the game or prevent any 
communication, but will never gain any information. 

All this reasoning is nice, provided that Alice and Bob 
are able to find the value of the threshold Dc for the pro- 
tocol that they want to use. That's why it is important to 
establish quantitative trade-offs between the information 
acquired by Eve and the error rate. For this calcula- 
tion, one should assume that Eve has applied the most 
powerful strategy consistent with quantum mechanics. 
Therefore, the problem of estimating Eve's information 
for a given disturbance is equivalent to finding her opti- 
mal eavesdropping attack on the protocol that is used. 
This is a very difficult problem and, to date, the com- 
plete solution is not known for any of the existing pro- 
tocols. Nevertheless, the problem can be solved if Eve 
is restricted to the so-called incoherent attacks. In what 
follows, we mainly focus on these attacks, that involve 
QCMs. The last paragraph of this subsection, however, 
will be devoted to the possibility of more general quan- 
titative links between QKD and cloning. 



B. Incoherent attacks and QCMs 

1. Generalities 

An incoherent attack is defined by two conditions: (i) 
Eve interacts individually and in the same way with the 
states travelling from Alice to Bob; (ii) she measures the 
quantum systems she has kept after the possible sifting 



This is a very reasonable assumption for any cryptographic sce- 
nario. Indeed, it seems difficult to design a secure protocol if 
one cannot exclude the possibility that Eve has access to Alice's 
preparation of quantum states, or Bob's measurement results. 



phase^^ but before any reconciliation process has started. 
In other words, the hypothesis is that after the sifting 
phase, Alice, Bob and Eve share a list of classical random 
variables, identically distributed according to a probabil- 
ity law P{A, B, E). Under this hypothesis, the fraction of 
secret bits R that can be extracted by Alice and Bob us- 
ing reconciliation protocols with one-way communication 
satisfies the bound of Csiszar and Korncr ( 1978) 

R = I{A: B) - min {/(A : E),I{B : E)} (81) 

where I{X : Y) H{X) + H{Y) - H{XY) is the mutual 
information between two parties^^. This result formalizes 
the intuition according to which, if Eve has "as much 
information as Alice and Bob" , it is impossible to extract 
a secret key. Therefore, Eve's optimal individual attack 
is the one that, for a given error rate D — that is, for 
a given value of I{A : B) — 1 — H{D) — maximizes 
I {A : E) and I{B : E). This defines the figure of merit 
for eavesdropping with incoherent attacks. 

If we go back to the physical implementation of such 
attacks, we see that Eve is going to "transfer" some in- 
formation about the original state onto the state of a 
particle that she keeps and measures later. Under this 
perspective, it seems rather natural to guess that the in- 
teraction defining the best individual attack is the 1 — > 2 
asymmetric QCM that clones in an optimal way all pos- 
sible preparations by Alice, i.e. the set of states {IV'i)^}' 
although there is no a priori link between the optimal- 
ly of cloning, based on the single-copy fidelity lO, and 
the optimality of eavesdropping defined just above. This 
intuition was proved to hold in the following cases: 

• BB84 protocol ijBennett and BrassardL Il984|l : Al- 
ice chooses her preparation among the four states 
I ± x) and I ± ?/) of a qubit, which belong to the 
equator of the Bloch sphere. One can see that 
Eve's optimal individual attack uses the asym- 
metric phase - covari ant cloning machine (see III.D|) 
l)Fuchs et al\ . Il997j) . The security condition as- 
sumes an easy form: a secret key can no longer 
be extracted as soon as FBob = Fevc, that is, the 
critical value for the error rate is D™'^"^ = I — Fevc- 
Using gOl, ~ 14.6%. We shall come back 

to this example in full detail in the next paragraph. 



Therefore, individual attacks require a quantum memory. 
The function H is the usual Shannon entropy. While we were fin- 
ishing this review, the i dea of "p re-processing" was introduced in 
quantum cryptography iKraus e t al, 2005; Rcnncr et al., 2005). 
Quite astonishingly, these authors found that security bounds 
can be improved by letting Alice randomly flip some of her bits. 
The reason is that this procedure decreases Alice's correlations 
with Eve much more than her correlations with Bob. This re- 
sult implies that, apart from the six-state protocol, in which the 
attacks depend on a single parameter which is the quantum bit 
error rate (QBER), the truly optimal incoherent attacks may 
not be those which have been presented in the previous litera- 
ture. Since this is an open research problem, we haven't taken 
these new considerations into account in the main text. 
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• Six-s t ate protocol l)Bechnianii-Pasauinucci and GisinL 
ll999HBrudll998|) : Alice's preparation is the same 
as in BB84 plus the poles of the sphere, | ±z)- 
Again, the interaction defining the optimal attack 

is the universal asymmetric QCM (see IILC|I . 
Indeed, it turns out that to optimally clone these 
six states is equivalent to clone all the states in 
the Bloch sphere. One can see that the critical 
disturbance such that R (|81(l goes to zero is 
jjincoh ^ 15.7%. Note that in the six-state 
protocol Eve's attack is more limited than in BB84 
because she has to (imperfectly) clone all the 
states in the sphere. This intuitively explains why 
Alice and Bob can tolerate a larger disturbance. 

• Continuous variable pr otocols, using both squeezed 
and coherent states llCerf. Lgvv and van AsscheL 
I2OOII: iGrosshans and Grangieil l2002|) : there also 
exists a link between security and the no-cloning 
theorem. Indeed, the well-known security limit of 
3 dB, common to all these protocols for the case 
of direct reconciliation, can be understood as the 
point where Eve's clone becomes equal to Bob's. 

The connection between cloning machines and eaves- 
dropping attacks has also been exploited for other 
protocols and scenarios. For instance, asymmet- 
ric 2 — > 2-1-1 cloning machines have been dis- 
cussed for eavesdropping on practical implementations 
of QKD, with no clairr i of optimalitv l|A9 m_el-ffllJ. 12? 
ICurtv and LiitkenhausL 120041 iNiederberger et all \2( 
Going to higher dimensional systems, the relation be- 
tween cloning machines and i ncoherent eavesdropping 
strategies has been analyzed llBrnfi and Macchiavelloi 
|2P02; C erf. Bourennane et all I20n2^ . Here, optimal- 
ity is conjectured but no t proved (see in this context 
iKaszlikowski et all (l2004l)). In the case of the proto- 
col invented bv lScarani. Acm. R ibordv. and GisirJ 1120041) 
(SARG04), the optimal incoherent eavesdropping is not 
known, but the best attack which has been found by 
iBranciard et al\ l)2005|) does not make use of the cor- 
responding optimal doner (which would be the phase- 
covariant one, as for BB84). 



2. Optimal incoherent attacl< on the BB84 protocol 

As a completely worked-out example, we describe the 
optimal incoherent attack on the BB84 protocol. Sup- 
pose that the BB84 protocol is run with the bases of 
the eigenstates of ax and ay; it is then no surprise 
that the optimal incoherent attack is obtained when Eve 
makes a copy of each qubit using the phase-covariant 
doner described in III.DI (Fuchs et ai, 1997). However, 
for eavesdropping in cryptography there is a difference 
between the two implementations that we presented, the 
one H39|l wit hout ancilla and the one II41II with an an- 
cillary qubit lA cin. Gi siii and Scarani 1200 J: lAcm et all 
l2004l lDurt arid Dui . i200|) . Intuitively, the reason is that 




some kind of information is stored in the ancilla as well, 
and Eve has an access to it. Here we show in detail what 
happens. 

Let's study the doner without ancilla first. For sim- 
plicity, we focus on an item where Alice has sent | + 2;) , 
and suppose that Bob has measured a^ so that the item 
will be kept after the bases-reconciliation. Using H39|l . the 
flying qubit becomes entangled to Eve's qubit according 
to 



ir)^^ - _L(|o)|o)+cos77|i)|o) 



sm?7|i 



|1» -(82) 



Bob's qubit is thus in the state pB = ^(1 + sin^ rja^ + 
cos tjax), so that the measurement of a^ gave him the cor- 
rect outcome with the probability Fab = {+^\pb\ + x) ^ 
^(1-1- COST]), which is indeed the fidelity of his clone as 
expected. The Alice-Bob mutual information is there- 
fore I{A : B) = 1 - H{Fab)- Similarly, Eve's qubit is 
in the state pE = 5(1 + cos^ -qaz + s^T^rjax)^ whence she 
will guess the state sent by Alice correctly with prob- 
ability Fae = 5(1 + sinry). The Alice- Eve mutual in- 
formation is therefore I {A : E) — 1 — H{Fae)- Ob- 
viously, I {A : B) = I{A : £■) for 77 = f , that is for 
an error rate Dab = 1 — Fab — 0.1464. However, the 
security criterion for one-way communication (|81|l says 
that I{A : B) must be larger than the minimum be- 
tween I{A : E) and I{B : E), so we need to compute 
the mutual information Bob-Eve as well. From the state 
(|H2Jl, we can compute the probability that Eve's symbol is 
equal to Bob's, knowing that both measure a^: Pbe = 
\{+x,+x\-^be)? + \{-x,-x\^be)? = i (1-H isin2?7); 
whence the mutual information I{B : E) ~ \ — H{Pbe)- 
It can be verified that I{B : E) < I{A : B) whenever 
F>AB < \] from Eq. JSlJ, Alice and Bob could always 
extract a key, as long as their correlation is not zero^"^. 
This is too good to be true; and indeed, the use of the 
machine with an ancillary qubit yields a more reasonable 
scenario. 

To study the machine with an ancilla^ we suppose that 
Alice and Bob use the same basis, but we consider both 
eigenstates of ax ■ Using , the flying qubit | ± x) ^ 
becomes entangled to Eve's two qubits according to 
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(|000) +c|011) -f s|101) 



±c|100) ±s|010) ± |111)) (83) 

where c = cos 77 and s — sinrj. Bob's qubit is in the 
state pb ~ ^(1 i cos rjax), which gives the same fi- 
delity as above as expected. The easiest way to see 
what Eve can do with her two qubits consists of writ- 
using the basis | ± x) for B and the Bell 
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We note here tha t this analysis was done fir st in the Introduction 
of the article by IScarani and GisinI i200lD : but an unfortunate 
mistake in the computation of Pbe, Eq. (5), prevented them 
from reaching the correct conclusion. 
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basis = ^(|00) ± 111)), = ^(|01) ± |10)) for 
Eve's qubits, then in applying on Eve's qubits the unitary 
transformation |$+> |00), |*+) |10), |$") 
l^*^) |01). After this transformation, the states read 

|f±) ^ Vf\±x) \x±) |0) T^lTx) Ixt) |1> (84) 

where F = i±£ is Bob's qubit fidehty, = 1 - the 

disturbance, and |x±) = VF\0) ± VD\1)- Now Eve's 
strategy is clear. First, she measures Cz on qubit £2'. 
if she finds |0), resp. |1), she knows that Bob's bit is 
identical or opposite, respectively, to Alice's bit. This 
information is deterministic, and implies that Eve has as 
much information on Bob's bit as she has on Alice's bit: 
I {A : E) — I{B : E). This solves the main problem 
of the machine without ancilla. For completeness, let's 
conclude the calculation by computing I {A : E). To 
guess Alice's bit. Eve must distinguish between the two 
non-orthogonal states |x±) of qubit Ei, with a priori 
probabilities p+ — — ^ since Alice sends j + x) and 
I — x) with the same probability. It is known ijHelstromL 
that the maximal information she can obtain is 
I{A:E)^l- H{P) where P = 5 (l + ^/T^WMW) ■ 
Since |(x+|x-)l = cosrj, we recover the expected result 
P = i(l + sin7?). 

In summary: without ancilla. Eve can make the best 
possible guess on the bit sent by Alice (because the ma- 
chine realizes the optimal phase-covariant cloning) but 
has very poor information about the result obtained by 
Bob. Adding the ancilla does not modify the estima- 
tion of Alice's bit but allows Eve to deterministically 
symmetrize her information on Alice and Bob's symbols. 
However, the two machines are equally good from the 
point of view of cloning. 

C. Beyond incoherent attacks 

All the links that we have discussed between QKD 
and quantum cloning hold in the case of incoherent at- 
tacks. However, one can also expect a relation between 
cloning and eavesdropping in more general security anal- 
ysis. Consider the BB84 protocol, and assume that Eve 
interacts individually with the states sent by Alice, but 
she can delay her measurement until the end of the rec- 
onciliation process and then possibly perform collective 
measurements. These t ypes of attacks are often c alled 
co llective. The results of Dcveta k and Winter! l)200 5') and 
of iRenner and KonTS ((2004) imply that there exists a 
protocol achieving a key rate 

R = I{A: B) -mm {x{A:Eq),x{B: Eq)}, (85) 

which can be understood as the generalization of H81|) to 
the case where Eve's variables are quantum (whence the 
index Q). The quantity x is the so-called Holevo bound 
IHoIcvo, 1973), which bounds the maximal information 
on Alice or Bob's symbol accessible to Eve through her 
quantum states. Indeed, the presence of Eve's attack 



defines an effective channel between Alice (or Bob) and 
Eve. For this channel, when Alice encodes the symbol 
AT = 0, 1 on the quantum state li^x), Eve receives the 
state obtained by tracing out the qubit that goes to 
Bob. Holevo's bound then reads 

X{X : E) = S{pe) ~ \s{pl) - \s{p\\ (86) 

where S denotes the von Neumann entropy and ps = 

{p% + pI)I'2- 

If Eve uses the phase-covariant cloning machine, we 
know p%^ = Trs (|r±)(r±|) from Eq. ^ and can com- 
pute R. After some simple algebra, one can see that the 
critical error Dc at which R (jHSJ is zero is defined by 
1 — 2H(D ^) = 0. Remarkab l y, this equation is the same 
as in the IShor and Preskilll l)200(]() proof of security of 
the BB84 protocol, and leads to a critical disturbance of 
Dc ~ 11%. The Shor-Preskill proof of security does not 
make any assumption on Eve's attack: it is thus remark- 
able that the same bound can be reached by a collective 
attack in which the individual quantum interaction is de- 
fined by the phase-covariant QCM. Actually, the attack 
based on the phase-covariant cloning machine is optimal, 
in the sense that it minimizes (|85|l for a fixed disturbance. 

D. Conclusive balance 

The relation between the no-cloning theorem and the 
security of quantum cryptography is certainly deep. 
However, it is not clear at all how to associate quan- 
titative results for cryptography to some explicit form 
of imperfect cloning, because cloning is not equivalent 
to eavesdropping. In particular, the relevant figure of 
merit that define Eve's optimal attack is a priori un- 
related to the single-copy fidelity Q that is optimized 
when constructing QCM s — se e also the discussion by 
iBrufi. DiVincenzo et al\ l)l998(l . Still, the connection 
has proved to be strong and fruitful in the case of in- 
dividual attacks, and possibly even beyond. 

V. STIMULATED EMISSION AS OPTIMAL CLONING 
OF DISCRETE VARIABLES IN OPTICS 

In this Section, we discuss how the well-known am- 
plification phenomenon of stimulated and spontaneous 
emission of light is closely related to optimal universal 
cloning. The results are stated and commented on in 
IV.AI in IV. Bl we re-derive the main results using a phe- 
nomenological model. 

A. Cloning as amplification 

1. Encoding of discrete states in different modes 

Section IIIII was devoted to the cloning of coherent 
states of a quantum oscillator; all the discussion, espe- 
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cially about the implementations, was carried out having 
in mind a single mode of the light field as an example 
of a quantum oscillator. In this Section, we consider the 
light field too, but in a different perspective: the quan- 
tum system is now the discrete-level system encoded in 
some modes of the field. The typical example here is po- 
larization: for a given energy uj, the light field has two 
independent modes aniui) and ay(w), corresponding to 
two orthogonal polarizations "horizontal" and "vertical" . 
We can then define a qubit as 

al,(^)|vac) = |0) (87) 
aUc^)|vac) = |1) (88) 

where \vac) is the vacuum state of the field. According 
to this correspondence, for any pair of complex numbers 
CH,cv such that |c//p -I- jcyp = 1, we can define a cre- 
ation operator — [c/f a^(a;) + cyay(cij)] such that 

al\vac) = \tP) = ch\0)+cv\1). (89) 

In this sense, polarization in a given frequency mode de- 
fines a qubit. Obviously, the N-photon Fock state in 
which all the photons are prepared in the state lip) reads 

li^f^ = Ivac) . (90) 

The construction clearly generalizes: we can encode a 
qudit with any d orthogonal modes ai, 

In Section IIIII the unknown parameters were the pa- 
rameters defining a coherent state in a given mode (i.e., 
a quantum continuous variable); here, a Fock state of N 
photons is prepared in a mode which is a linear com- 
bination of d modes aj : the unknown parameters are the 
coefficients of the linear combination (that is, a qudit). 
Therefore, we are going to refer back to the cloning of 
discrete- level systems (Sectional. In all that follows, 
for simplicity, we discuss explicitly the example of polar- 
ization in a single energy mode. As might be expected, 
the results e xtend to any disc rete level system encoded in 
field mo des (|Fan et a/.l .' l200^ : we sketch it in paragraph 
IVI.A.3l for the case of time-bin encoding. 

2. Main result 

Consider a light amplification process based on stimu- 
lated emission. We consider two orthogonal polarization 
modes of a monochromatic component of the field, and 
suppose that (i) N photons of a given unknown polar- 
ization are already present in the medium, and (ii) the 
component of the field associated to exactly M > N 
photons is post-selected after amplification. Because 
spontaneous emission is always present, it is impossi- 
ble that all M photons are deterministically emitted in 
the same polarization mode as the input ones: even 
for large N, there will always be a small probability 



that a photon is emitted in the orthogonal mode. The 
claim is that, if the probabilities of emission are inde- 
pendent of the polarization, this amplification process 
attains the optimal fidelity for universal N M cloning 
of qubits. This w as notic e d in the very early days of 
quan t um cloning llMandelL iMilonni and Hardied . 

Il982t IWoot ters an d Zurekl Il982() for the 1 ^ 2 pro- 
cess, an d was general i zed rnore recently t o any cloning 
process ijKempe et al l l2000HSimon et o.lllmm . In the 
rest of this Section, we derive the same resul ts using the 
morephenomenological approach sketched in lFasel et al\ 
(l2002fl . 

B. Phenomenological model 

1. Definition and fidelity 1^2 

Consider an inverted medium that can emit photons 
of any polarization with the same probability (thus, we 
introduce by hand the assumption of universality). We 
focus on a monochromatic component of the field. Sup- 
pose that N photons are initially present in a given po- 
larization mode, say |V^); and suppose that at the output 
of the amplifier M — N + k photons are found, the ini- 
tial ones plus k new ones that have been emitted by the 
medium^^. For this amplification process, the single-copy 
fidelity is the probability of an output photon picked at 
random to be polarized as the input ones. The no-cloning 
theorem tells us that the k additional photons cannot be 
deterministically in the same polarization mode \V) as 
the N input ones; and indeed, we know that stimulated 
emission is always associated with spontaneous emission. 

The derivation of the fidelity for an amplification 1 — > 2 
can be easily described. If a photon is present in mode 
\V), a second photon in this mode can be emitted ei- 
ther by spontaneous or by stimulated emission, the two 
processes being equiprobable; while a photon in mode 
\H) can be emitted only by spontaneous emission. Thus 
the probabilities P[2,0|l,0] and P[l, 1|1,0] that the new 
photon is emitted in the same mode as the input or 
in the orthogonal mode, are related to one another as 
P[2,0|l,0] = 2P[1,1|1,0]: the probability for the new 
photon to be polarized along \V) is |. If we now pick a 
photon out of the two, with probability ^ it is the original 
one, whose polarization is certainly \V); with probabil- 
ity i, it is the new one. So, the probability for finding 
one of the output photons in mode \V) (the fidelity) is 



Photons are bosons: the output state will be a symmetrized state 
of the M photons in which photons are certainly in state \V) 
and the other ones are in a suitable state. So it does not really 
make sense to speak of the " initial photons" as if they had con- 
served any distinctive property whatsoever after amplification. 
Still, one can use this loose language, provided that the relation 
between spontaneous and stimulated emission, Eq. 1921 . is as- 
sumed. This relation is a consequence of the bosonic nature of 
the field. 
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^xl + ix| = |, exactly the same as for optimal sym- 
metric universal 1 2 cloning. 

In the rest of this Section, we generalize the same con- 
siderations to derive the fidelity for the N ~* M cloning. 



2. Statistics of stimulated emission 

As a preliminary for what follows, we need to give the 
statistics of the process of stimulated and spontaneous 
emission. This amplification process will be completely 
described by the probabilities P[N + l,k - l\N,0], < 
I < k, that I photons are emitted in mode \V) and k — I 
in mode \H). We normalize these probabilities so that 
they sum up to the total probability of the process: 



^P[N + l,k-l\N,0\ = P{N~^M). (91) 
/=o 

We stated above the simplest example, P[2, 0|1,0] — 
2P[1, 1|1,0]; now we want to show that the general ex- 
pression is 



P[N + l,k-l\N,{)\ = 



N\l\ 



P[N,k\N,Q]. (92) 



For definiteness, we consider a medium formed of M 
"Lambda" atoms, in which a unique excited state |e) 
can decay into two orthogonal ground states \gH) and 
\gv) through the emission of the correspondingly polar- 
ized photon. Omitting coupling constants, the Hamilto- 
nian describing the interaction between the medium and 
the field is 



fly CTyj 



adj. 



(93) 



where cr^^ = |.g//)(e| and ay j — \gv){e\ acting on atom 
j. The system is prepared so that all the atoms are in 
the excited state, N photons are in mode \ V) and none in 
mode \H): |in) = |iV, 0; e,e, ...,e). The interaction leads 



to |'0(t)) = e 



-iHr/h 



in) where r is the interaction time. 



At the output, we post-select on the states such that 
exactly k photons have been emitted; more specifically, 
we want I additional photons in mode \V) and k — I 
in mode \H). By reading the state of the atoms after 
the interaction, one could in principle know which atom 
has emitted which photon, so all the possible output 
states are distinguishable. Consider all the possible pro- 
cesses in which the first k atoms have emitted a photon 
— all the other processes contribute with equal weight: 
|out(^)) = |A^ + /,fc-?;5^(i),...,5r^(fc),e,...,e) where f is 
a fc-item sequence containing / times the symbol "V" and 
k - I times the symbol "H" . Then the probabihty P[N + 



k - 
k 



l\N,0] is proportional to J^e \{out{£,)\H''\in) 



(7V + ;,fc-;|a[.'a^'' \n,0) 



= kl 



{N+iy. 
N\ n 



This 



proves Eq. (|92|l . As a consequence of it, Eq. H91|) becomes 
P{N ^M) ^ P[N, fc|iV, 0] (94) 

since Ya^q %Vn' = ''(jv+*l)! fc! ■ We can now go back to 
cloning and prove the main result of this Section. 



3. Fidelity N ^ M 

The fidelity of the amplification process is defined as 
usual, as the probability of finding a photon in the same 
mode as those of the input: 



Fn^m 



where 



(0 



NM 



1=0 



N+{1)nm 
M 



P[N + l,k-l\N, 0] 
P{N M) 



(95) 



(96) 



is the average number of additional photons produced 
in the same mode as the input. Inserting H92|l and H94(l 

into ^ and using Y!1=o I '^WUT ^ E,n~io ^^^FT^' 
obtain {1)nm ~ k Replacing k — M — N we obtain 

Fn^m = -^{N +[N - M)^) which is exactly the 
Gisin-Massar result (|16|l . 

Our phenomenological model shows that the link be- 
tween amplification by an inverted medium and quantum 
cloning is " semi-classical" , in the following sense: the re- 
lation is derived rigorously from quantum mechanics 
(the bosonic nature of the field) ; but once this relation is 
admitted, the rest becomes just classical event counting. 
Note in particular how, due to Eq. (|92|l . {1)nm and conse- 
quently Fm^m become independent of both P\N, fc| A^, 0] 
and P{N M). These last probabilities, i.e. how fre- 
quent the process A^ — > M is, are in general difficult 
to compute and depend on the detailed physics of the 
invert ed medium (Simon et al. ( 2000) and Kcmp e et al\ 
l)2000l) provide some examples). However, we know that 
whenever such an amplification process takes place, it 
realizes the optimal symmetric N M UQCM. 



VI. EXPERIMENTAL DEMONSTRATIONS AND 
PROPOSALS 

This Section reviews the experiments that have been 
proposed and often performed to demonstrate quantum 
cloning. They all refer to universal cloning, symmetric 
or asymmetric. Phase-covarian t cloning has als o been 
the object of r ecent proposals l)De Chiara et alV l2004t 
lFiurasekll2003(l . 
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A. Polarization of photons 

The connection between stimulated emission and 
quantum cloning (Section [VJ is the essential ingredient 
in most of the optical implementations of qubit 1 — > 2 
cloning machines. The usual scheme consists of sending 
a single photon into an amplifying medium. In the ab- 
sence of this photon, the medium will spontaneously emit 
photons of any polarization (or mode). But if the photon 
is present, it stimulates the emission of another photon in 
the same mode, i.e. this mode is enhanced. However, the 
process of spontaneous emission can never be suppressed, 
which means that the quality of the amplification process 
is never perfect. This is indeed a manifestation of the no- 
cloning theorem; remarkably, as discussed in detail in the 
previous Section, it achieves optimal cloning. 

Before discussing this kind of cloning, we must men- 
tion that one of the first optical experiments that imple- 
mented the Buzck-Hillery clo ning (III.A[) was an e xperi- 
ment using only linear optics l|Huang et oi.Ll200ll) . The 
idea there is to realize the three needed qubits with a 
single photon: one qubit is the polarization, the other 
two are defined by the location of the photon into four 
possible paths. As well-known, the optical device called 
polarizing beam-splitter (PBS) realizes the CNOT gate 
between he polarization and the path mode. The experi- 
mental setup to achieve cloning is a suitable arrangement 
of PBS and optical rotators. This being mentioned, we 
focus on cloning through amplification processes. 



1. Experiments with parametric down-conversion 

Most optical impl ementations of t he 1 2 

cloning machine (iDe Martini et all l2000l l2002t 
iLamas-Linares et a,l\ . l2002ft use "parametric down- 
conversion (PDC) as the amplification phenomenon 
(see Fig. A strong laser pulse pumps a non- linear 
crystal. With small probability the pulse is split into two 
photons, called signal S and idler I. For pulsed type-II 
frequency degenerated PDC the Hamiltonian reads 



(97) 



Notice that this Hamiltonian is invariant under the same 
unitary operation in both polarization modes, {VS^ HS) 
and {VI, HI). The photon to be cloned and the the 
pump pulse propagate through the crystal at the same 
time. Because of the Hamiltonian symmetry, one can 
take as the state to clone, |l,0)g = Oy^jvac), without 
losing generality. Indeed the rotational symmetry of the 
Hamiltonian guarantees the covariance of the transfor- 
mation. The state after the crystal is 



(98) 



We can expand the previous expression into a Taylor se- 
ries. Since the down-conversion process only happens 
with small probability, we restrict our considerations to 



the first terms in the expansion. The zero-order term 
simply corresponds to the case where no pair of photons 
is produced, so at the output one finds the initial state 
unchanged. The first order term is more interesting, since 
the resulting normalized state gives 



1^1-2) 



12,0)^10,1), -W-|1,1)^|1,0)„ (99) 



i.e. the searched cloning transformation (|13|) . It is 
straightforward to see that if the two photons in the sig- 
nal mode are separated, for instance by means of a beam- 
splitter, the obtained fidelity is equal to 5/6. Indeed the 
first term corresponds to ideal cloning, while only one of 
the two photons in the second term is equal to the initial 
state, so 



^,2115 
F=lx- + -x- = -. 
3 2 3 6 



(100) 



The factor \/2 is a manifestation of the stimulated emis- 
sion process. It only appears when the initial photon 
is completely indistinguishable from the down-converted 
photon in the signal mode. That is, the two photons 
should perfectly overlap in space, time and frequency. 
Any effect increasing the distinguishability of these two 
photons, such as a difference in the coherence lengths 
of the pump pulse and down-converted photons, must 
be compensated in order to achieve a near to optimal 
cloning. Moreover, it has to be stressed that this im- 
plementation of the cloning machine is conditioned on 
the fact that the three detectors (the one for the idler 
mode and the two in the state analyzers) click. Then, it 
is assumed that one photon was present in each mode. 
Note that there are cases in which more than one pair 
is produced by the crystal, or the initial state to be 
cloned actually contains more than one photon. These 
spurious processes slightly decrease the optimality of the 
cloning transformation. In any case, the reported fi- 
delities are equal to 0.81 zfc 0.01 llLam as-Linares et a,lY 
'2002") and 0.810 ± 0.008 l)De Martini et all. l2002l |2004 
PcUiccia et ai, 2003), very close to the theoretical value 
5/6 « 0.83. Interestingly, the photon in the idler mode, 
or anti-clone, gives the optimal realization of the quan- 
tum universal NOT gate. The optimal fidelity for this 
transformation is 2/3, w hile the reported e xperimental 
fidelity is .630 ± 0.008 l|De Martini et a.ll l2002l l2004t 
iPelhccia et a i. 200^. 



More recently, an alternative version of the 1 — > 2 
quantum doner for qubits ha s been proposed a r id car - 
ried out bv llrvine etai\ l)2004|) and bv lRicci et ai\ l)2004|) . 
This is based on the fact that two identical photons bunch 
at a beam-splitter. The experiment is much simpler but 
cannot be generalized to iV — > Af cloning. The exper- 
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FIG. 5 Experimental implementation of the 1 2 universal 
cloning machine for qubits. The laser works in pulsed mode. 
A very small fraction of the pulse, below single-photon level, 
serves as probabilistic preparation of the photon to clone. The 
rest of the pump pulse is frequency doubled and sent to a 
non-linear crystal. If the prepared photon is indistinguishable 
from one of the two down-converted photons, optimal cloning 
is achieved. The other down-converted photon is often called 
ant i- clone. 



imental set-up^^ is schematically shown in Fig. The 
initial state is combined with one of the down-converted 
photons into a balanced beam-splitter. It is a well- 
known result that if the photons separate after the beam- 
splitter, a projection onto the singlet state l^*") has been 
achieved. In the other cases, the photons have been pro- 
jected with 



52 = l-|*-)(*-|, 



(101) 



onto the two-qubit symmetric subspace. Tracing out 
the second down-converted photon, the transformation 
on the photons impinging the beam-splitter is indeed 
equal to H17|) . conditioned on the fact that they stick 
together. On the other hand, it is straightforward to see 
that the transformation on the second down-converted 
photon is the optimal U-NOT gate, i.e. the photon in 
the idler mode is equal to the anti-clone (compare with 
III.A.3|) . In a similar way as for the previous implementa- 
tion, the quality of the cloning process crucially depends 
on the fact that the two photons arriving at the beam- 
splitter define the same mode. This means that, as above, 
they have to be completely indistinguishable. Moreover, 
multi-photon pulses also deteriorate the quality of the 
cloning process. The observed fidelities for cloning were 
approximately 0.81. 



2. Proposals for asymmetric cloning 

In this section we show how the previous realiza- 
tions can be modified in order to cover asymmetric 



Note t hat this is the same set-up as for the teleportation of a 
qubit iBennett et ad 119931) . 
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FIG. 6 Alternative implementation of the 1^2 universal 
cloning machine for qubits. The photon to be cloned is now 
combined into a balanced beam-splitter with one of the down- 
converted photons. When the two photons stick together, two 
optimal clones of the initial state are obtained. As in the first 
scheme, the second down-converted photon provides the anti- 
clone. 



cloning machines. Indeed, it has been shown very 
recently that some of these transformations can be 
obtained by combining into beam-splitters the pho- 
tons produced by a symmetric cloning machine fFili^l 
2004; Fiurasck, FiUp and Ccrf, 2005; Iblisdir et al, 20oi 
Iblisdir. Acm and Gisinl l2005j) . At the moment of writ- 
ing, these experiments have not yet been performed. 

A proposal for the experimental realization of the 
asymmet ric 1 ^ 1 -| - 1 cloning machine for qubits was 
given by iFilid l)2004j) . It is represented in Fig. It is 



convenient for the analysis of this scheme to rewrite the 
output of the symmetric machine H99|l using Cerf's for- 
malism, 



a 



2\/3 



I*- 



(102) 

where |^ ) is the singlet state. It is simple to see 
that this state is equivalent to Cerf's construction when 
V — V3/2 (|31l) . but with a simple relabelling of the 
Bell states for the second clone and the anti-clone. The 
asymmetry between the clones can now be introduced by 
changing the ratio of the amplitudes for the first term 
and the rest. A possible way of achieving this is by suc- 
cessfully applying the projector Pasym = at + h\^^) \ 
to the second clone and the anti-clone, where a and b are 
such that t- — Pasym > 0. ludccd, the states PasymlV'1—2) 
define, up to normalization, the family of states H31|l . 
Changing the ratio between a and h, one can optimally 
adjust the asymmetry between the quality of the two 
clones, i.e. the ratio between v and x according to Cerf's 
notation. A beam-splitter of transmittivity T condi- 
tioned on the fact that the photons at the output are 
separated gives a simple optical implementation of this 
projector. Indeed, some simple algebra shows that the 
corresponding operation is equal to 



Pasym{T) = {2T - 1)1 + 2(1 - T)\^-) (^'- 



(103) 
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FIG. 7 The figure shows the optical implementation of the 
1 — > 1 + 1 and 1 — > 1 + 1 + 1 optimal cloning machines. For 
the 1^1 + 1 case, the symmetry between the clones of the 
1^2 cloning machines is broken by combining one of the 
clones with the anti-clone into a beam-splitter. The degree 
of asymmetry depends on the transmittivity T. The idea can 
be naturally generalized to the 1 — > 1 + 1 + 1 case. 



When T = 1 no operation is performed, Pasym{T = 1) = 
U, and the two clones are symmetric, Fa = Fb — 5/6. 
When T decreases, some asymmetry is introduced be- 
tween the two clones, since Fa increases while Fb wors- 
ens. In the hmiting case T — 1/2, a projection onto the 
singlet is achieved, as expected, and the state in mode A 
is projected onto the initial state. Fa = 1 and Fb = 1/2, 
that is, the cloning transformation has been undone. In 
fact, since a projection onto the singlet is realized, the 
detected photons after the beam-splitter were the ones 
produced in the crystal. This implies that the photon 
in mode A must be equal to the initial state. All the 
interesting values lie between these two limiting cases, 
1/2 < T < 1. Indeed, one can see that the trade-off 
between the obtained fidelities Fa and Fb saturates the 
cloning inequality l|23|) . 

Note that for all these experimental proposals, the suc- 
cessful implementation of the searched cloning transfor- 
mation depends on the detection of three photons (all the 
detectors click). Interestingly, one can see that changing 
the number of post-selected photo ns gives other asym- 
metric cloning machines jFiurasck, Filip and CerA l2005t 
llblisdir et "^■ 120041 llbiisdk. Acin and Gisinl. 1200^ ) . in a 
way similar t o wh at happens for the symmetric case 
l)Simon et all l2000(l . Indeed, denoting by N, Ma and 
Mb the number of photons in the initial mode and modes 
A and B (see Fig. [7|l , it has been shown that the opti- 
mal 1^1 + 2 cloning machine is recovered when = 1 
and Ma = 1,Mb = 2 and Ma = 2, Mb = 1, and also 
the 2-^2 + 1 case when N — 2 and same post-selection 
for modes A and B. Unfortunately, the transformation 
when N = Ma = Mb = 2 does not correspond to the 
optimal 2^2 + 2 machine. At present, it seems that the 
previous construction only works for the 1 — > 1 -f A^ and 
A' ^ A^ -I- 1 cases, and a feasible optical implementation 
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FIG. 8 Scheme of the experimental set-up of Ref. iFasel et all 
120021) . see paragraph I VI. A.Sl Everything takes place into op- 
tical fibers, the QCM itself being a pumped Er-doped fiber. 
Upper figure: effectively realized experiment for cloning of 
polarization states (qubit). Lower figure: possible variation 
using time-bin encoding, that would lead to optimal cloning 
of qudits (here, d — 3). 



of the N — > M1+M2 machine, with Mi, M2 > 1 remains 
as an open question. 

Remarkably, Filip's construction can be further gen- 
eralized. Indeed, exploiting the anti-symmetrization by 
means of beam-splitter allows us to extend this scheme 
to the 1 1 -I- 1 -I- 1 case, where three copies of 
the initial state are produced in such a way that the 
trade-off between the fidelities is optimal. As shown in 
Fig. [7| it is possible to consider a more complex situ- 
ation when the production of two pairs by the pump 
pulse, instead of one, is stimulated by the presence of 
the photon to be cloned. The corresponding state is 
equal to the o utput of a 1 —^ 3 symmetric machine, 
as discussed bv lSimon et al\ l)2000() . Actually, there are 
three clones and two anti-clones, namely the two pho- 
ton in the idler mode. Now, one can apply twice the 
anti-symmetrization explained above, as shown in Fig.|7| 
After much algebra, one can see that the fidelities for 
the clones in modes A, B and C are equal to those 
defining th e optimal 1 — > 1 -I- 1 -I- 1 c loning machine of 
llblis dir gL ( 20041 . llblisdir. Acm"and Gisi n (2W5) and 
Fiura sek. Filip and Cerj l)2005fl . Although unproven, it 
seems quite likely that this construction works for any 
number of clones, and that all 1 1 + . . . + 1 cloning 
machines can be optimally realized by combining into 
beam-splitters, and conditioned on the number of pho- 
tons, the output of the 1 ^ A^ symmetric machine. 



3. Cloning in an erbium-doped fiber 

Parametric down-conversion is an amplification 
medium that has been studied intensively because it al- 
lows to create entangled photons. In the field of telecom- 
munication optics, however, the common device used for 
amplification of light are optical fibers doped with erbium 
ions. These rare-earth ions can be pumped onto an ex- 
cited state and then constitute an inverted medium that 
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can lase at telecom wavelengths. iFasel et al\ l)2002() stud- 
ied quantum cloning due to such an amplifier. The ex- 
periment consisted of sending classical, very weak pulses 
of (say) vertically {V) polarized light into an erbium- 
doped fiber. At the output, light is amplified, but is no 
longer perfectly polarized because of spontaneous emis- 
sion: some light has developed in the polarization mode 
orthogonal to the input one (horizontal, H) . The fidelity 
of the classical amplification is defined as the ratio of the 
intensities = louty / Iout,tot- 

A theoretical ana lysis based on a sem inal paper on 
maser amplification ijShimoda et a/.l Il957j) provides a re- 
markable prediction: let ^in,out be respectively the mean 
number of photons in the input and the output field (i.e., 
the intensity of these fields, in suitable units). Then it 
holds 



outf^in l^out ~\~ l^i: 



(104) 



Here, the parameter Q is related to the phenomenology of 
the emission process: Q = 1 means that all Erbium ions 
are excited, so that there is no absorption; Q = means 
that emission and absorption compensate exactly, Q < 
means that the absorption in the medium overcomes the 
emission. We see that in the ideal case Q — \, the formula 
(|104|l for Fci looks exactly like the one for the optimal 
symmetric N ^ M cloning of qubits but for the 

fact that /im and ^out are not restricted to take integer 
values. This is a signature of the underlying quantum 
cloning in an experiment with classical states of light. In 
the actual experiment, the fit yielded Q = 0.8; for the 
cloning jjLin = 1 — > ^out = 1.94 ~ 2, a fidehty Fd ~ 0.82 
was observed, close to the optimal value | ~ 0.833. 

Although the experiment was performed with polar- 
ization, the same setup would allow the cloning of quan- 
tum states encoded in time-bins. With time-bin en- 
coding, it is very ea s y to go beyond t he qu bit case 
l)De Riedmatten et aZ.l.l200llThew aL'. '20041 In par- 
ticular, the present setup (Fig.|2J) would allow to demon- 
strate optimal cloning for higher-dimensional quantum 
systems. As an example to support this claim, we com- 
pute the fidelity in the computational basis for 1 — > 2 
cloning — that is, one photon was prepared in a given 
time-bin, and two photons are found in the outcome. The 
probability of finding the new photon in the good time- 
bin (associated to F = 1) is just twice the probability of 
finding it in any of the other d—1 time-bins (in which case 
F = 1/2, because half of the times we pick the original 
photon) . The average fidelity is then 



Fl^2id) 



2 X 1 + (d- 1) X i 
2+{d-l) 



d + 3 
2{d+l) 



(105) 



which is the optimal result, see III.B.ll Of course, one 
should show that the same fidelity holds for any super- 
position state, which is, however, quite evident when one 
is familiar with the physics of light amplification. As we 
mentioned above, this result is not limited to time-bins. 



but holds fo r any encoding of a qudit in different modes 
of the field l|Fan et all l2002|) : the time-bin encoding is 
possibly the most easily analyzed and implemented. 



B. Other quantum systems 

1. Nuclear spins in Nuclear Magnetic Resonance 

A way to achieve quantum cloning of nuclear spins us- 
ing Nucle ar Magnetic R esonance (NMR) has been pre- 
sented bv ICummins et a l. (2002), together with its ex- 
perimental realization. As usual in quantum information 
processing with NMR, many molecules are present in the 
sample and the process takes place among nuclear spins 
within each molecule. 

In the present experiment, the molecule is E-{2- 
chloroethenyl)phosphonic acid. After the peculiar pulse 
sequences needed to prepare the sample in a pseudo-pure 
state, a spin direction is encoded into the first qubit, 
which is the spin of the '^^P nucleus. The main part 
of the scheme is a pulse sequence that impl ements a ver- 
sion o f the optimal symmetric 1^2 QCM l|Buzek et a/J . 
I1997D that maps the quantum information onto the two 
other qubits — here, nuclear spins of two atoms. Be- 
cause of several unwanted mechanisms and imperfections, 
however, the measured fidelity for both clones was only 
F « 0.58, even lower than the value achievable with triv- 
ial cloning strategies fsee III. AT]) . 



2. Atomic states in cavity QED 

Implementations of the 1^2 UQCM for qubits using 
the techni ques of cavity QED have been proposed. The 
scheme bv lMilman et al\ ()200 3') uses four Rydberg atoms 
interacting with two cavities. Atom 2 carries the input 
state. After the suitable pulse sequence. Atoms 3 and 4 
are the two clones: as in the NMR experiment described 
iust above, t he tr ansformation is similar to the one of 
(Buzek et al ] lll997r) . Here however, the "circuit" is a new 
one, and the ancilla is not a single qubit, but two atoms (1 
and 2) and the state of the light field in the two cavities. 

IZou. Pahlke and MathisI l)2003() proposed a scheme 
that uses three atoms and three cavities; interaction 
between atoms within each cavity is required for this 
scheme. 



VII. PERSPECTIVES 

A. Some open questions 

At the end of this review, we address a few of the 
questions that are still open at the moment of writing. 
As far as possible, we list them in the same order as the 
corresponding themes appear in this review. 
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To our knowledge, all the study of optimal cloning 
has always supposed pure input states. The opti- 
mal cloning of mixed states is thus a completely 
open domain. Also, as we mentioned several 
times, there is no general result concerning state- 
dependent cloning, and the zoology of cases is a 
priori infinite. 

We have seen several times in this review (especially 
Sections IIIII and IIV|I that the single-copy fidelity 
is not always the most meaningful figure of merit. 
However, most of the QCMs are optimal according 
to it. What about other figures of merit? If the 
resulting QCMs are found to be different, is there 
a deep connection among all the results? 

The role of entanglement in cloning may be further 
elucidated. The trivial strategies discussed in para- 
graphs lTl.A.ll and lll.B.SI show that the fidelity Ftriv 
given in Eq. (|22|) can be achieved without using 
any coherent interaction between the clone and the 
copy. It seems quite plausible that this is the op- 
timal value one can attain using strategies without 
quantum interaction. Therefore, it would be inter- 
esting to understand more precisely what role en- 
tanglement plays in optimal cloning, e.g. by study- 
ing the entangling power of the optimal cloning 
machine or the entanglem ent properties of the cor- 
respo nding output states ijBrufi and Macchiavellol 
Note that in the limit of large dimen- 
sion, no entanglement is required for an optimal 
cloning. One could also look for links between these 
results and the entangl ement cloning machine of 
iLamoureux et all ()2004j) . 

Also the link between cloning and Bell's inequal- 
ities is not clear. Consider the setup of Fig. ^ 
The QCM is an existing one (not Herbert's hypo- 
thetical perfect doner), and let's suppose it univer- 
sal and symmetric for simplicity. Alice and Bob 
started with the singlet, which obviously violates 
Bell's inequalities. Alice keeps the quantum sys- 
tem A, Bob now has two quantum systems Bi and 
B2. Does pABi = PAB2 violate a Bell inequality? 
Certainly, it cannot violate any inequality with two 
settings on Bob's side, because Bob could measure 
one setting on par, and the other setting on PAB2 
l)Terhal et all |2003|) . But the general answer is un- 
known. 

The connection between optimal cloning and state 
estimation looks natural and, indeed, in paragraph 
III.EI we presented several results in that direction. 
However, it is still not known whether this connec- 
tion holds in general. Is it true for any arbitrary 
set of states, possibly with unequal a-priori proba- 
bilities, that the fidelities are equal for the optimal 
state estimation and for the optimal cloning in the 
limit of a large number of copies? 



• The relation to optimal eavesdropping is also not 
yet fully understood. For individual attacks on 
some quantum cryptography protocol, such as 
BB84 or the six-state protocol, it has been proven 
that the best strategy uses the cloning machines 
that are optimal to clone the set of states used for 
encoding. As we stressed in Section IIVI this cor- 
respondence is not obvious, since cloning is opti- 
mized for fidelities, whereas in eavesdropping one 
optimizes mutual Shannon information; and in- 
deed, it seems that the correspondence breaks down 
for the SARG04 protocol. More generally, it has 
been proven that security bounds can be obtained 
by restric ting attacks to th e so-called "collectiv e 
attacks" teraus et all l2005t iRenner et all l2005'l. 
and it is meaningful to ask whether the quantum 
interaction is described by the corresponding opti- 
mal doner. 

• The concepts and tools of cloning have proved use- 
ful for the foundations of quantum mechanics, for 
state estimation and for cryptography. Are there 
other domains, tasks, situations, etc. in which 
cloning can be useful? Or, can one find a more 
general principle which unifies optimal cloning, 
state estimation, and eavesdropping in cryptog- 
raphy, possibly with spontaneous and stimulated 
emission? 

• Qubits obey fermionic commutation relations, e.g. 
Wx, Cy} = 0. Optimal cloning of qubits can be im- 
plemented using spontaneous and stimulated emis- 
sion that comes from bosonic commutation rela- 
tions, ie [a,a^ — 1. What is the exact relation? A 
link between the particle st atistics and state esti- 
mation has been discussed fB ose e^"all . l2003(l . but 
to our knowledge there is no such study for cloning. 

• Many questions are also still open in the field 
of implementations of quantum cloning. Ob- 
viously, any form of cloning can (in princi- 
ple) be implemented with lin e ar opt ics using the 
iKnill. Laflamme and MilburnI 1)20011) scheme for 
quantum computation. Can one implement any 
cloning transformation using amplification through 
stimulated emission? If yes, can one it be done by 
linear-optics elements, or are other non-linear de- 
vices needed? Are there other "natural" phenom- 
ena that directly implement quantum cloning? 

This list will possibly shrink in the coming years as 
soon as these questions are answered. A regularly up- 
dated list of open problems in quantum information is 
available on the website of Reinhard Werner's group: 
www.imaph.tu-bs.de/qi/problems/problems.html. At 
the moment of this writing, no problems related to 
cloning are listed there, apart from, possibly, "Complex- 
ity of product preparations" proposed by Knill. 
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B. Conclusion: the role of cloning in quantum physics 

Quantum cloning is likely to remain an active topic for 
basic research, while simultaneously an ideal subject for 
teaching elementary quantum physics. The proof of the 
no-cloning theorem is so simple that it can be presented 
to students as soon as the linearity of the quantum dy- 
namics has been introduced, and much of quantum me- 
chanics can be presented as a consequence of this deep 
no-go theorem. Such a presentation would not follow the 
history of the discovery of quantum physics, but is much 
closer to the modern view of it in the light of quantum 
information theory. Optimal cloning clearly shows that 
incompatible quantities can be measured simultaneously 
(first clone the system, next perform different measure- 
ments on each clone), while illustrating that such mea- 
surements can't be ideal, i.e. can't be immediately re- 
producible. 

Apart from the issue of measurement, quantum cloning 
is closely related to many other aspects of quantum 
physics: to the no-signaling condition, both historically 
(|I.C|I and as limit for optimal cloning (|I.E.1|I : to the 
phenomenon of spontaneous and stimulated emissions, 
well known in quantum optics, see Section 0.. The no- 
cloning theorem also introduces in a natural way the idea 
of quantum cryptography, and optimal cloning suggests 
the way eavesdropping can be analyzed. Finally, it elu- 
cidates what is so sp ecial about quantum teleportation 
l)Bennett et allUdd^ : the original has to be destroyed in 
the process and the Bell-state measurement should not 
provide any information of the state to be teleported, 
otherwise there would be a contradiction with the no- 
cloning theorem (more precisely, with the optimal asym- 
metric cloning result presented in lll.Cp . 
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APPENDIX A: Notations and basic formulas for qubits 

A qubit is the simplest possible quantum system, de- 
scribed by the two-dimensional Hilbert space C . The 
algebra of operators acting on this space is generated by 
the Pauli matrices: 




In particular, Tr(a-fc) = and cr^ = 1 for fc = x,y,z; 
also, a^c^y — —GyGx — and all the cyclic permuta- 
tions hold. In the set of states, the computational basis 
{|0),|1)} is universally assumed to be the eigenbasis of 
CTz, so that: 

= |0) , ^.|1> = (Al) 

Normally, everything is always written in the computa- 
tional basis; only the eigenstates of Ux have a standard 
notation for convenience: | -l-a;) = |+) = -^(|0) -I- |1)) 

and I — a;) = | — ) = ^ The eigenstates of CTj, 

are|±y) = -i=(|0) ±"z|l)). 

The generic pure state of a qubit will be written 

IV) = a|0) + /3|1). (A2) 

The associated projector reads 

IV) (VI = ^(l + "•^) (A3) 

where the vector n = {{(^x)-,p, {<^y)^^ {'^z)^,) 
(2Re(a/3*),2Im(a/5*), lap - |^|2) is called Bloch vector. 
For pure states (the case we are considering here), its 
norm is 1: actually, all these vectors cover the unit sphere 
(called the Bloch sphere^ or the Poincare sphere if the 
two- level system is the polarization of light). Thus, there 
is a one-to-one correspondence between unit vectors and 
pure states of a two-level system given by the following 
parametrization in spherical coordinates: 

IV) = I n) = cos ^ |0) + e^'^ sin ^ |1) (A4) 

is the eigenstate for the eigenvalue -1-1 oi h ■ a, with n = 
'h{9,(f) = (sin ^ cos sin 6* sin cos 6*), with as usual 6 G 
[0, tt] and ip £ [0, 2tt]. Given that any projector takes the 
form ljA3|l , the general form of any mixed state can then 
be written: 

p = ^Pfe|Vfe)(Vfc| = i (l + m • ct) (A5) 
fc 

with m ~ X)fcPfc™fci norm of the Bloch vector is 
|m| < 1, with equality if and only if the state is pure. 

For the present review, it is also useful to mention some 
formulae and notations for the description of two qubits. 
As is well-known, a composed system is described by the 
tensor product of the Hilbert spaces of its components. 
So the Hilbert space that describes a two-qubit system is 

2 2 

7Y = C (g) C . The natural (" induced" ) computational 
basis on this space is the basis of the four eigenstates of 
CTz (S" cr^, namely (we omit the symbol of tensor product 
for states, when not necessary) |0)|0), |0)|1), |1)|0) and 
1 1) 1 1) . The most general pure state is any linear combina- 
tion of these. Although probably redundant in a paper 
on quantum information, we recall here that the most 
important feature of composed systems is the existence 
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of entangled states, that is, states that cannot be written 
as products iV'i) 'X' |V'2)- 

The basis formed with four orthogonal maximally en- 
tangled states {Bell basis) plays an important role; the 
notations are standardized by now: 





i=(|0)|0) + |l)|l)), 


(A6) 


1$-) = 


i=(|0)|0)-|l)|l)), 


(A7) 


= 


i=(|0)|l) + |l)|0)), 


(A8) 


1*-) = 


-^(|0)|1)-|1)|0)). 


(A9) 



We recall that is invariant under identical unitaries 
on both qubits, i.e. it keeps the same form in all the 
bases. If the eigenstates of (Tx^ycrn or of (jy(S)(Jy were taken 
as computational bases states, the Bell basis remains 
the same, simply relabelled: l^"'")^, = = \^~^)z^ 

I*-). = -i\^-)y = and = 1$+)^ = 1$-),. 

The general form of a density matrix of two qubits is 

Pab = ^ {I4, + ua ■ <Si t + 1 Igi fiB ■ 

where tij = Tr(pcri (8) aj). From this form, the partial 
traces are computed leading to 

PA,B = ^ (1 + nA,B ■ ct) . (All) 

If \hA\ = 1, then pA = Pa b. projector on a pure state; 
since a projector is an extremal point of a convex set, 
this necessarily implies pab = Pa® Pb and in particular 
tij = {nA)i {nB)j- 
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